Yes, you're correct here.

I contact @synologyofficial.bsky.social support, DMARC only works when the email server itself has related DNS record, and @npmjs.bsky.social only uses .com as it's email server, so .org doesn't have related DNS record, which results DMARC not working as expected. 🤦‍♂️

www.virustotal.com/gui/file/c68...

> Authentication: SPF, DKIM, and DMARC all failed.

I'll contact my email service provider @synologyofficial.bsky.social to check why DMARC didn't work for me in this case, and that's why I relaxed my vigilance. 🤦‍♂️

That's me been tricked sadly 😭 : bsky.app/profile/1stg...

cc @github.com @npmjs.bsky.social

I only checked the email address and trusted my @synologyofficial.bsky.social Email service with SPF and DMARC enabled, so I let my guard down. 😭

I still don't understand how is that possible to bypass the DMARC check.

My bad. 😭

All affected packages and versions are:

- eslint-config-prettier
- 8.10.1
- 9.1.1
- 10.1.6
- 10.1.7
- eslint-plugin-prettier:
- 4.2.2
- 4.2.3
- snyckit:
- 0.11.9
- @pkgr/core:
- 0.2.8
- napi-postinstall:
- 0.3.1

Thanks all, and sorry for my negligence.

Hi, any news here? ❤️

So why it's not enabled by default by Node.js itself?

What's the use case of using `pnpapi` without `process.versions.pnp` by the way? And how would it be auto installed by other PM?

How would that work comparing with checking `process.versions.pnp`?