# Package Manager Podcast Episodes

Like the [blog posts](/2026/01/09/package-management-blog-posts.html) and [papers](/2025/11/13/package-management-papers.html) collections, this is a running list of podcast episodes where people who build and maintain package managers talk about their work. Grouped by ecosystem, with a few cross-cutting episodes at the end.

The Manifest ([manifest.fm](https://manifest.fm)) is a podcast dedicated entirely to package management, hosted by Alex Pounds and me. I've listed its episodes under the relevant ecosystems below rather than in a separate section.

## JavaScript / TypeScript

**[JavaScript Jabber #052: Node npm](https://topenddevs.com/podcasts/javascript-jabber/052-jsj-node-npm-with-isaac-schlueter)** (Isaac Schlueter, 2013). Early discussion of npm's role in the Node ecosystem, semantic versioning, and module discovery.

**[The Changelog #101: npm Origins and Node.js](https://changelog.com/podcast/101)** (Isaac Schlueter, 2013). npm's creator on its origins and how to get paid to do open source.

**[JavaScript Jabber #099: npm, Inc.](https://topenddevs.com/podcasts/javascript-jabber/099-jsj-npm-inc-with-isaac-schlueter-laurie-voss-and-rod-boothby)** (Isaac Schlueter, Laurie Voss, and Rod Boothby, 2014). The founding of npm, Inc. and turning a community project into a company.

**[JavaScript Jabber #127: Changes in npm Land](https://topenddevs.com/podcasts/javascript-jabber/127-jsj-changes-in-npm-land-with-forrest-norvell-rebecca-turner-ben-coe-and-isaac-z-schlueter)** (Forrest Norvell, Rebecca Turner, Ben Coe, and Isaac Schlueter, 2014). The full npm team on what was changing inside the registry and CLI.

**[JavaScript Jabber #174: npm 3](https://topenddevs.com/podcasts/javascript-jabber/174-jsj-npm-3-with-rebecca-turner-and-forrest-norvell)** (Rebecca Turner and Forrest Norvell, 2015). The npm tech lead on npm 3's changes to dependency tree flattening.

**[JavaScript Air #047: Yarn](https://javascriptair.com/episodes/2016-11-02-bonus/)** (Sebastian McKenzie, Konstantin Raev, Yehuda Katz, and Christoph Pojer, 2016). The original Yarn team explaining why they built it, recorded right after launch.

**[JavaScript Jabber #266: npm 5.0](https://topenddevs.com/podcasts/javascript-jabber/jsj-266-npm-5-0-with-rebecca-turner)** (Rebecca Turner, 2017). npm 5's lockfile, performance improvements, and the design decisions behind them.

**[JavaScript Jabber #294: Node Security](https://topenddevs.com/podcasts/javascript-jabber/jsj-294-node-security-with-adam-baldwin)** (Adam Baldwin, 2018). The Node Security Platform, dependency vulnerabilities, and integrating security into npm workflows.

**[Founders Talk #61: Building npm and Hiring a CEO](https://changelog.com/founderstalk/61)** (Isaac Schlueter, 2019). Isaac on the journey of hiring his successor and the business side of running npm.

**[The Undefined Podcast: The Future of JavaScript Tooling](https://undefined.fm/radio/the-future-of-javascript-tooling-with-sebastian-mckenzie)** (Sebastian McKenzie, 2019). The Babel and Yarn creator on open source burnout, working at Facebook, and the Rome project.

**[The Changelog #326: The event-stream compromise](https://changelog.com/podcast/326)** (Dominic Tarr, 2018). The maintainer whose package was hijacked explains how it happened. The best incident postmortem in podcast form.

**[JavaScript Jabber #357: event-stream Package Vulnerabilities](https://topenddevs.com/podcasts/javascript-jabber/jsj-357-event-stream-package-vulnerabilities-with-richard-feldman-and-hillel-wayne)** (Richard Feldman and Hillel Wayne, 2019). The event-stream attack from the community's perspective, and whether paying maintainers would improve security.

**[The Changelog #355: The Economics of Open Source](https://changelog.com/podcast/355)** (CJ Silverio, 2019). npm's former CTO on who owns the JavaScript commons, VC-funded registries, and the Entropic federated alternative.

**[JavaScript Jabber #366: npm](https://topenddevs.com/podcasts/javascript-jabber/jsj-366-npm-with-mikeal-rogers)** (Mikeal Rogers, 2019). Node.js history, alternate CLIs, Pika, import maps, and where package management was heading.

**[The Manifest #9: Typosquatting](https://manifest.fm/9)** (Adam Baldwin). Security in npm, typosquatting attacks, and what exploits look like in practice.

**[PodRocket: What makes pnpm performant](https://podrocket.logrocket.com/pnpm)** (Zoltan Kochan, 2022). pnpm's creator on its content-addressable store and symlink architecture.

**[devtools.fm #154: pnpm and the Future of Package Management](https://www.devtools.fm/episode/154)** (Zoltan Kochan). How pnpm revolutionized dependency installation in the JavaScript ecosystem.

**[Software Engineering Daily: pnpm](https://softwareengineeringdaily.com/2025/09/18/pnpm-with-zoltan-kochan/)** (Zoltan Kochan, 2025). pnpm's background and where package management in the web is heading.

**[The Changelog #443: Exploring Deno Land](https://changelog.com/podcast/443)** (Ryan Dahl, 2021). Only Ryan Dahl's second podcast appearance. Covers the full arc from Node regrets to Deno.

**[Syntax #737: JSR: The New TypeScript Package Registry](https://syntax.fm/show/737/jsr-the-new-typescript-package-registry-npm-killer)** (Luca Casonato, 2024). JSR's design as an ESM-only, TypeScript-first registry that complements npm.

**[Syntax #815: Deno 2](https://syntax.fm/show/815/deno-2-with-ryan-dahl)** (Ryan Dahl, 2024). Deno 2's npm package support, web standards, and framework integration.

**[JS Party #282: The massive bug at the heart of npm](https://changelog.com/jsparty/282)** (Darcy Clarke, 2023). A deep technical disclosure of an integrity bug in the npm registry.

**[Syntax #688: vlt with Darcy Clarke](https://syntax.fm/show/688/ex-npm-employee-making-a-new-package-manager-vlt-with-darcy-clarke)** (Darcy Clarke). Darcy introduces vlt, a next-generation package manager and registry.

**[JS Party #295: Reflecting on Bun's big launch](https://changelog.com/jsparty/295)** (Jarred Sumner, 2023). Bun 1.0, its relationship to Node, and how a VC-backed startup sustains an open source runtime.

**[JavaScript Jabber #524: Supply Chain Security, Part 1](https://topenddevs.com/podcasts/javascript-jabber/supply-chain-security-part-1-jsj-524)** (Feross Aboukhadijeh, 2022). Malware trends targeting npm dependencies and how Socket detects them beyond traditional vulnerability scanning.

**[JavaScript Jabber #525: Supply Chain Security, Part 2](https://topenddevs.com/podcasts/javascript-jabber/supply-chain-security-part-2-jsj-525)** (Feross Aboukhadijeh, 2022). Continued discussion on shifting mindsets around dependencies and understanding dependency lifecycle management.

**[The Changelog #482: Securing the open source supply chain](https://changelog.com/podcast/482)** (Feross Aboukhadijeh). Socket's launch and the broader problem of npm supply chain security.

## Python

**[Podcast.\_\_init\_\_ #54: Pip and the Python Package Authority](https://www.pythonpodcast.com/episodepage/episode-54-pip-and-the-python-package-authority-with-donald-stufft)** (Donald Stufft, 2016). pip and PyPI's primary maintainer on the work involved in keeping them running.

**[Talk Python To Me #64: Inside the Python Package Index](https://talkpython.fm/episodes/show/64/inside-the-python-package-index)** (Donald Stufft, 2016). PyPI handling over 300 TB of traffic per month and the infrastructure behind it.

**[Talk Python To Me #159: Inside the new PyPI launch](https://talkpython.fm/episodes/show/159/inside-the-new-pypi-launch)** (Nicole Harris, Ernest Durbin III, and Dustin Ingram, 2018). The launch of pypi.org replacing the legacy system after 15+ years.

**[Podcast.\_\_init\_\_ #264: Dependency Management Improvements in Pip's Resolver](https://www.pythonpodcast.com/episodepage/pip-resolver-dependency-management-episode-264)** (Pradyun Gedam, Tzu-ping Chung, and Paul Moore, 2020). The new pip dependency resolver, its design, and the challenge of writing good error messages.

**[Talk Python To Me #377: Python Packaging and PyPI in 2022](https://talkpython.fm/episodes/show/377/python-packaging-and-pypi-in-2022)** (Dustin Ingram, 2022). 2FA rollout, securing the supply chain, and the state of PyPI.

**[Talk Python To Me #406: Reimagining Python's Packaging Workflows](https://talkpython.fm/episodes/show/406/reimagining-pythons-packaging-workflows)** (Steve Dower, Pradyun Gedam, Ofek Lev, and Paul Moore, 2023). How the packaging landscape expanded with Poetry, Hatch, PDM, and others.

**[Talk Python To Me #453: uv - The Next Evolution in Python Packages?](https://talkpython.fm/episodes/show/453/uv-the-next-evolution-in-python-packages)** (Charlie Marsh, 2024). uv's initial launch as a pip replacement.

**[The Changelog #660: Reinventing Python tooling with Rust](https://changelog.com/podcast/660)** (Charlie Marsh, 2025). Why Python, why Rust, how Astral makes everything fast.

**[Talk Python To Me #476: Unified Python packaging with uv](https://talkpython.fm/episodes/show/476/unified-python-packaging-with-uv)** (Charlie Marsh, 2024). uv's expansion from pip replacement to full project manager.

**[Talk Python To Me #520: pyx - the other side of the uv coin](https://talkpython.fm/episodes/show/520/pyx-the-other-side-of-the-uv-coin-announcing-pyx)** (Charlie Marsh, 2025). Astral's Python-native package registry and how it complements PyPI.

**[SE Radio #622: Wolf Vollprecht on Python Tooling in Rust](https://se-radio.net/2024/06/se-radio-622-wolf-vollprecht-on-python-tooling-in-rust/)** (Wolf Vollprecht, 2024). Mamba and Pixi, building Python infrastructure in Rust.

**[Talk Python To Me #439: Pixi, A Fast Package Manager](https://talkpython.fm/episodes/show/439/pixi-a-fast-package-manager)** (Wolf Vollprecht and Ruben Arts, 2023). Pixi's high-performance package management with full conda compatibility.

**[Talk Python To Me #115: Python for Humans projects](https://talkpython.fm/episodes/show/115/python-for-humans-projects)** (Kenneth Reitz, 2017). Requests, pipenv, and the philosophy behind them.

**[The Python Show #41: Python Packaging and FOSS with Armin Ronacher](https://www.pythonshow.com/p/41-python-packaging-and-foss-with)** (Armin Ronacher, 2024). The creator of Flask and Rye on the state of Python packaging and open source sustainability.

**[Open Source Security Podcast: Python security with Seth Larson](https://opensourcesecurity.io/2024/10/20/episode-451-python-security-with-seth-larson/)** (Seth Larson, 2024). What happens when open source developers are paid to do security work.

**[Talk Python To Me #435: PyPI Security](https://talkpython.fm/episodes/show/435/pypi-security)** (Mike Fiedler, 2023). PyPI's safety and security engineer on malware detection, trusted publishers, and the 2FA mandate for all publishers.

## Ruby

**[The Manifest #3: RubyGems with Andre Arko](https://manifest.fm/3)** (Andre Arko, 2017). How he became lead maintainer of RubyGems and Bundler, and what led to Ruby Together.

**[Ruby Rogues #45: Bundler](https://topenddevs.com/podcasts/ruby-rogues/045-rr-bundler-with-andre-arko)** (Andre Arko, 2012). Early, in-depth discussion of Bundler's design and purpose.

**[Rooftop Ruby #23: Head of Open Source at Ruby Central](https://www.rooftopruby.com/2108545/episodes/13495314)** (Andre Arko, 2023). His journey to Bundler, how Ruby Together came to be, and continuing that work at Ruby Central.

**[Friendly Show #5: How we got RubyGems and Bundler](https://www.friendly.show/2278525/episodes/13995352)** (Andre Arko, 2023). The full history of RubyGems and Bundler, the cost of maintaining them (~$500k/month), and future plans.

**[The Rails Changelog #19: Exploring RubyGems](https://www.railschangelog.com/19)** (Jenny Shen). The mechanics of dependency resolution in RubyGems, including compact indexes.

**[Changelog & Friends #113: The RubyGems Debacle](https://changelog.com/friends/113)** (Mike McQuaid and Justin Searls, 2025). The Ruby Central governance controversy, money in open source, and what sustainability means.

## Rust

**[The Manifest #8: Cargo and Crates.io](https://manifest.fm/8)** (Carol Nichols, 2017). The features that make Cargo the envy of other package managers, and the sustainability of the Rust ecosystem.

**[The Changelog #151: The Rust Programming Language](https://changelog.com/podcast/151)** (Steve Klabnik and Yehuda Katz, 2015). Yehuda Katz designed Cargo by rolling up five years of innovation from Bundler, Node, and Go.

**[Open Source Security Podcast: crates.io trusted publishing](https://opensourcesecurity.io/2025/2025-08-cratesio-trusted-publishing-tobias/)** (Tobias Bieniek, 2025). Steps crates.io is taking to enhance supply chain security through trusted publishing.

## Go

**[The Manifest #4: Go dep](https://manifest.fm/4)** (Sam Boyer, 2017). Package management for Go, SAT-solving, and dependency resolution before Go modules existed.

**[Go Time #77: Dependencies and the future of Go](https://changelog.com/gotime/77)** (Russ Cox, 2018). The Go tech lead on the Vgo proposal that became Go modules.

**[Go Time #188: SIV and the V2+ issue](https://changelog.com/gotime/188)** (Tim Heckman and Peter Bourgon, 2021). Semantic import versioning and the community friction it caused.

**[Go Time #321: Dependencies are dangerous](https://changelog.com/gotime/321)** (panel, 2024). The polyfill.io supply chain attack and Go's "a little copying is better than a little dependency" proverb.

**[Go Time #86: Go modules and the Athens project](https://changelog.com/gotime/86)** (Marwan Sulaiman and Aaron Schlesinger, 2019). How Go module proxies work, the Athens project, and the transition from GOPATH to modules.

**[SE Radio #489: Sam Boyer on Package Management](https://se-radio.net/2021/12/episode-489-sam-boyer-on-package-management/)** (Sam Boyer, 2021). A broad, ecosystem-agnostic discussion of package management as a discipline.

## PHP

**[The Manifest #15: Packagist](https://manifest.fm/15)** (Nils Adermann, 2019). PHP package management with Composer and Packagist from its co-creator.

## Dart

**[The Manifest #5: Pub](https://manifest.fm/5)** (Natalie Weizenbaum, 2017). How Dart's pub works and a new algorithm for better dependency resolution errors, which became PubGrub.

## Java / JVM

**[The Manifest #6: Maven](https://manifest.fm/6)** (Brian Fox, 2017). The history of Maven Central, how Minecraft DDoS'd the service, and the future of Java dependency management.

**[The Manifest #12: Clojars](https://manifest.fm/12)** (Daniel Compton, 2019). Clojars, the Clojure package registry, and its relationship to Maven.

**[OpenSSF "What's in the SOSS?" #9: Downloading Known Vulnerabilities](https://openssf.org/podcast/2024/07/16/whats-in-the-soss-podcast-9-sonatypes-brian-fox-and-the-perplexing-phenomenon-of-downloading-known-vulnerabilities/)** (Brian Fox, 2024). Why 96% of vulnerable downloads from Maven Central had known fixes available.

**[TechCast #53: Gradle Creators, Part 1](https://chariotsolutions.com/podcast/episode-53-gradle-creators-hans-dockter-and-adam-murdoch-part-1/)** (Hans Dockter and Adam Murdoch, 2010). Gradle's creators on the build system's design and origins.

**[TechCast #54: Gradle Creators, Part 2](https://chariotsolutions.com/podcast/episode-54-gradle-creators-hans-dockter-and-adam-murdoch-part-2/)** (Hans Dockter and Adam Murdoch, 2010). Continuation of the Gradle discussion.

**[SE Radio #628: Hans Dockter on Developer Productivity](https://se-radio.net/2024/08/se-radio-628-hans-dockter-on-developer-productivity/)** (Hans Dockter, 2024). Gradle's creator on developer productivity and build tooling.

## Swift / Apple

**[The Manifest #2: CocoaPods](https://manifest.fm/2)** (Orta Therox, 2017). How CocoaPods grew, the arrival of Swift Package Manager, and the Danger project.

**[Swift by Sundell #75: The Swift Package Ecosystem](https://www.swiftbysundell.com/podcast/75/)** (Dave Verwer and Sven A. Schmidt, 2020). The Swift Package Index launch and the state of the Swift package ecosystem.

**[Swift Package Indexing #62: Transitioning CocoaPods into Maintenance Mode](https://swiftpackageindexing.transistor.fm/episodes/62-whats-the-plan-for-transitioning-cocoapods-into-maintenance-mode)** (Orta Therox, 2025). CocoaPods' transition to maintenance mode as Swift Package Manager takes over.

## .NET

**[Hanselminutes #238: NuGet Package Management with Phil Haack](https://www.hanselminutes.com/238/aspnet-mvc-3-rc-and-nuget-package-management-with-phil-haack)** (Phil Haack, 2010). Recorded during PDC week, this is essentially the launch episode for .NET's package manager, back when it was still called NuPack.

## C / C++

**[The Manifest #13: Conan](https://manifest.fm/13)** (Diego Rodriguez-Losada, 2019). Package management problems specific to C/C++ and the road to Conan 1.0.

**[CppCast #56: Conan](https://cppcast.com/diego-rodriguez-losada/)** (Diego Rodriguez-Losada, 2016). Early discussion of Conan from its creator.

**[CppCast #153: Vcpkg](https://cppcast.com/robert-schumacher/)** (Robert Schumacher, 2018). vcpkg's evolution from a Visual Studio migration tool to a cross-platform C/C++ dependency manager.

## Haskell

**[Haskell Interlude #68: Michael Snoyman](https://haskell.foundation/podcast/68/)** (Michael Snoyman, 2025). The creator of Stack and Stackage on building a build tool that "just works" for Haskell.

## Elm

**[Elm Radio #5: How (And When) to Publish a Package](https://elm-radio.com/episode/publishing-packages/)** (2020). Elm's enforced semantic versioning, where the compiler diffs package APIs and rejects publishes that break compatibility without a major bump.

## Elixir

**[Thinking Elixir #3: Hex Package Manager](https://podcast.thinkingelixir.com/3)** (Eric Meadows-Jonsson, 2020). Hex's creator on how Elixir's package ecosystem handles versioning and resolution.

## Erlang

**[Mostly Erlang #067: Rebar 3](https://mostlyerlang.wordpress.com/2015/05/12/067-rebar-3/)** (Fred Hebert, 2015). Fred Hebert and the panel on rebar3, Erlang's build and dependency management tool.

## Perl

**[The Underbar #3: MetaCPAN](https://underbar.cpan.io/episodes/3/)** (Olaf Alders, Mickey Nasriachi, Shawn Sorichetti, and Graham Knop, 2025). The MetaCPAN team on the project's history and future, recorded at the Perl Toolchain Summit in Leipzig.

**[The Underbar #6: CPAN Testers](https://underbar.cpan.io/episodes/6/)** (Doug Bell, Ruth Holloway, Ferenc Erki, and Breno G. de Oliveira, 2025). How CPAN Testers went down, and how a new team formed around its lone remaining maintainer to get things running again.

**[The Underbar #7: CPAN Security Group](https://underbar.cpan.io/episodes/7/)** (Salve J. Nilsen, Stig Palmquist, and others, 2025). The CPAN Security Group on supply chain security for Perl's package ecosystem.

**[FLOSS Weekly #246: Pinto](https://twit.tv/shows/floss-weekly/episodes/246)** (Jeffrey Thalhammer, 2013). Custom CPAN-like repositories with Pinto, covering why pinning dependencies matters for reproducible builds.

## System package managers

**[The Manifest #1: Homebrew](https://manifest.fm/1)** (Mike McQuaid, 2017). The lead maintainer on Homebrew's design, how it uses GitHub as a database, and patching upstream.

**[The Changelog #35: Homebrew and OS X Package Management](https://changelog.com/podcast/35)** (Max Howell, 2010). Early interview with Homebrew's creator about the project's origins.

**[The Changelog #223: Homebrew and Package Management](https://changelog.com/podcast/223)** (Mike McQuaid, 2016). The 1.0.0 release and growth to almost 6000 unique contributors.

**[freeCodeCamp Podcast #204: Mike McQuaid](https://www.freecodecamp.org/news/the-most-important-skills-going-forward-with-cto-homebrew-maintainer-mike-mcquaid-podcast-204)** (Mike McQuaid, 2026). How big open source infrastructure gets built and maintained.

**[The Manifest #14: Debian and Reproducible Builds](https://manifest.fm/14)** (Chris Lamb, 2019). How package management works in Debian and the Reproducible Builds project.

**[The Changelog #437: Into the Nix Ecosystem](https://changelog.com/podcast/437)** (Domen Kozar, 2021). Nix's origins from Eelco Dolstra's university research, how it works as a "Swiss Army knife of DevOps," and the road ahead.

**[Happy Path Programming #73: Nix - Functional Programming for Software Packaging](https://creators.spotify.com/pod/profile/happypathprogramming/episodes/73-Nix---Functional-Programming-for-Software-Packaging-with-Domen-Koar-e1t5onm)** (Domen Kozar, 2023). Nix as functional programming applied to the packaging problem.

**[foss-north #33: Flatpak with Alexander Larsson](https://www.podchaser.com/podcasts/foss-north-the-pod-4749563/episodes/flatpak-with-alexander-larsson-141124423)** (Alexander Larsson, 2021). Flatpak's creator on its design, containers, and Linux desktop application distribution.

**[postmarketOS Podcast #30: Natanael Copa](https://cast.postmarketos.org/episode/30-Interview-Natanael-Copa-Alpine-Linux/)** (Natanael Copa, 2023). Alpine Linux's creator on why apk-tools is so fast and planned improvements for future versions.

## Scientific computing

**[The Manifest #11: Spack](https://manifest.fm/11)** (Todd Gamblin). The package manager for supercomputers and the unique challenges of HPC packaging.

**[Talk Python To Me #94: Guaranteed Packages via Conda and Conda-Forge](https://talkpython.fm/episodes/show/94/guarenteed-packages-via-conda-and-conda-forge)** (Phil Elson, Kale Franz, and Michael Sarahan, 2017). How conda distributes pre-compiled binaries across platforms, conda-forge's community packaging model, and what distinguishes conda from pip.

**[Talk Python To Me #198: Catching Up with the Anaconda Distribution](https://talkpython.fm/episodes/show/198/catching-up-with-the-anaconda-distribution)** (Peter Wang, 2019). Anaconda's co-founder on conda as a cross-platform package manager, enterprise adoption, and the sustainability challenges of open source infrastructure that millions depend on.

**[The Manifest #16: Conda Forge, Mamba, and Packaging Con](https://manifest.fm/16)** (Wolf Vollprecht, 2021). Conda-forge, the Mamba solver, and the first Packaging-Con.

**[RCE 103: EasyBuild](https://www.rce-cast.com/Podcast/rce-103-easybuild.html)** (2016). EasyBuild's approach to managing scientific software builds on HPC systems.

**[FLOSSforScience EP012: EasyBuild](https://flossforscience.com/podcast/season-1-episode-12)** (Kenneth Hoste, 2018). The problems of installing scientific software on HPC systems and how EasyBuild addresses them.

## Cross-ecosystem

**[The Manifest #7: The Update Framework](https://manifest.fm/7)** (Trishank Karthik Kuppusamy). TUF, a security layer for package managers that grew out of the Tor Project. Also covers Uptane for automotive package management.

**[The Manifest #10: Open Source Licensing](https://manifest.fm/10)** (Kate Stewart). How open source licensing intersects with software packaging, from the SPDX perspective.

**[OpenSSF "What's in the SOSS?" #20: Package Repository Security](https://openssf.org/podcast/2024/11/26/whats-in-the-soss-podcast-20-jack-cable-of-cisa-and-zach-steindler-of-github-dig-into-package-repository-security/)** (Jack Cable and Zach Steindler, 2024). Trusted Publishing, which started in PyPI and spread to RubyGems and npm.

**[OpenSSF "What's in the SOSS?" #21: Alpha-Omega](https://openssf.org/podcast/2024/12/10/whats-in-the-soss-podcast-21-alpha-omegas-michael-winser-and-catalyzing-sustainable-improvements-in-open-source-security/)** (Michael Winser, 2024). Securing critical dependency chains one project at a time, the "fix, fork, or forego" framework for upstream vulnerabilities, and why human trust beats automated reports.

**[Security Now #807: Dependency Confusion](https://twit.tv/shows/security-now/episodes/807)** (Steve Gibson, 2021). A detailed walkthrough of Alex Birsan's dependency confusion research, where uploading packages to public registries matching internal names at Apple, PayPal, and others achieved remote code execution.

---

What's missing? There are ecosystems I know less about and episodes I haven't found. [Let me know](https://mastodon.social/@andrewnez) or [open a PR](https://github.com/andrew/nesbitt.io).

---

By Andrew Nesbitt (https://nesbitt.io). Markdown version of https://nesbitt.io/2026/02/09/package-manager-podcast-episodes.html