3 ms·
Does anyone understand why npm isn't adding these sorts of features?
by Ozzie_osman 1y ago
Does anyone understand why npm isn't adding these sorts of features?
- deleted 1y ago[deleted]
- JoshuaEN 1y agoThere was an NPM RFC for this feature (though not as focused on supply chain attacks) in 2022, but the main response mirrored some of the other comments in here. "waiting a length of time doesn’t increase security, and if such a practice became common then it would just delay discovery of vulnerabilities until after that time anyways" https://github.com/npm/rfcs/issues/646#issuecomment-1282497113 https://github.com/npm/rfcs/issues/646#issuecomment-12824971...