Standard Reader

package-managers

Andrew Nesbitt

Package management and open source metadata expert. Building Ecosyste.ms, open datasets and tools for critical open source infrastructure.

@andrewnez.bsky.social1readers162poststoday

LatestRecent writing

What Happened to tea.xyz

Reading the tea leaves

package-managerssupply-chain

Forms of Open Source Government

Open source has more forms of government than countries do.

open-sourcemaintainers

Package Manager Patents

A reference list of patents and applications relevant to package manager design, with notes on prior art.

package-managershistory

This Week in Package Management: 6 June 2026

Releases, advisories, and articles from across the package management world

package-managersweekly

Install-script allowlists

A survey of install-script allowlist mechanisms across package managers and language ecosystems.

package-managerssecurity

gittuf - a signed log for git refs

Branch protection is a row in someone else's database

Skills Registry Threat Models

How long until we see a CVE filed against a markdown file?

securitypackage-managers

The Infosec Phrasebook

a/s/l/threat model?

This Week in Package Management: 30 May 2026

Releases, advisories, and articles from across the package management world

package-managersweekly

Composer's dependency policies

uBlock Origin for composer install

package-managerssecurity

Protestware for coding agents

printMessageForCodingAgents()

supply-chainsecurity

Package managers that package package managers

brew install spack install conda install cargo install uv tool install pip install poetry add pdm add conan

package-managers