rfcs VS orogene

npm workspaces plus Wireit works far better than Lerna, in my experience.

https://github.com/google/wireit

Wireit's ability to specify actual script dependencies, do caching (and on Github actions), and it's long-running service script support make it much more useful and comprehensive than Lerna.

I agree that this should be built into npm. There's an RRFC for it here: https://github.com/npm/rfcs/issues/706

It's coming https://github.com/npm/rfcs/blob/main/accepted/0042-isolated-mode.md

This just got accepted as a proposal in NPM: https://github.com/npm/rfcs/pull/626

npm also plans to support pnpm-style node_modules

(I usually end up removing npm ci from CI/CD since I think it is way too slow and want to cache node_modules from previous builds; I'm waiting for https://github.com/npm/rfcs/issues/415 to land to make this fail-safe npm install --from-lockfile. Yarn does support this already)

I started following this problem from the discussion at npm about making install scripts opt-in. But install scripts are not the only threat, there are more ways for malicious actors:

Interesting, but no support for workspaces yet: https://github.com/orogene/orogene/issues/161

Yarn is actually slower than npm these days. Here's some current benchmarks:

https://github.com/orogene/orogene/blob/main/BENCHMARKS.md

In short, Kat left npm at some point in 2019 after a whole debacle with leadership. For a while they were working on orogene with a couple other ex-npm people, but nothing came out of that. It's really a shame because it looked really promising and they had a lot of cool ideas.