Security Notice: GitLab has uncovered a widespread malicious npm supply-chain attack that potentially can destroy user data. All teams are required to audit packages. Further information can be found under the Computer Security Report for November 2025 and the original blog post in https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/
The following discussion from !86 (merged) should be addressed:
I think we should consider cutting down the CI here. Now everything is conda-based I don't think it makes much sense as we spend more time debugging it than we gain in stability.