3 ms·

> if the repo/vendor/maintainer pulls the release If your package system allows this switch to another one, like, right now. NPM, Cargo, etc. don't allow thi

> if the repo/vendor/maintainer pulls the release If your package system allows this switch to another one, like, right now. NPM, Cargo, etc. don't allow this (they "unlist" versions, but they don't "remove" them, i.e. you can't search for them, but they are still there).

cerved 5y ago
there are other benefits with proxies but fair point
chmod775 5y ago
> NPM, Cargo, etc. don't allow this I'd say the likelihood is about 50% you have a NPM package in your dependencies right now that pulls some binary or whatever from a random S3 bucket during installation.