Make sure you subscribe to https://socket.dev/blog/category/security-news to see the latest in JS supply chain security (we’ll update you if any reports affect Eleventy!)

Some good practices to help mitigate in your projects:

1. Use `npm install --ignore-scripts` (or use pnpm)
2. Use `npm ci` and a package-lock.json on your build server