Make sure you follow @socket.dev to see the latest in JS supply chain security (we’ll update you if any reports affect Eleventy!)

Some good practices to help mitigate in your projects:

1. Use `npm install --ignore-scripts` (or use pnpm)
2. Use `npm ci` and a package-lock.json on your build server