5 ms·
For packages that popular, authority of more than one people should required or at least some kind of delay until npm update/install command catch it unless spe
by alienalp 5y ago
For packages that popular, authority of more than one people should required or at least some kind of delay until npm update/install command catch it unless specifically that version set.
If i remember correctly if someone hijacked my npm account and published something i wouldn't even noticed it. Obviously publisher should get an email or maybe even sms.
- 8organicbits 5y agoThe delay idea sounds promising. I'd want that as part of npm, but I suppose someone could build an NPM proxy that adds the delay. Has anyone tried something like this, even for a different ecosystem?
- seniorsassycat 5y agoIt's possible with AWS CodeArtifact using EventBridge to promote after a delay. The company I work for has a three day delay on npm.
- okhobb 5y agoA large part of npm's staggering success is the very low friction to publish packages. I worry that any mitigation that slows down the publishing side of things would kill innovation in the ecosystem.
- 8organicbits 5y agoI imagined an optional delay for npm install/update. That way it would only slow down users who wanted more time.
- deleted 5y ago[deleted]