3 ms·
And then if there is a CVE along the way someone has to go and maintain it and thats exactly what no one wants to do
by Snetry 5y ago
And then if there is a CVE along the way someone has to go and maintain it and thats exactly what no one wants to do
- michaelmrose 5y agoSeems like they could simply provide a way to notify users and service of something like that without providing the ability to unilaterally yank it.
- Snetry 5y agoHow are you going to distribute that message? Over NPM? No one is going to read that. At best the community can stand up and fork which means they have to move ownership to some rando
- michaelmrose 5y agoWell first by communicating with NPM which could take an extraordinary action to break builds in the case where this is the least bad actions or by doing something logical and providing developers or company contacts to register to receive warnings ideally based on parsing actual dep versions and transmitting a message directly to the designated contact for a project.