3 ms·
The concern is not 'could' happen, but _does_ happen. I know this could occur in many places. But where it seems highly prevalent is NPM. And I am genuinely th
by vintagedave 11mo ago
The concern is not 'could' happen, but _does_ happen. I know this could occur in many places. But where it seems highly prevalent is NPM.
And I am genuinely thinking to myself, is this making using npm a risk?
- cluckindan 11mo agoJust use dependency cooldown. It will mitigate a lot of risk.
- yoavm 11mo agoIf you started your Node project yesterday, wouldn't that mean you'd get the fix later?
- cluckindan 11mo agoObviously you bypass the cooldown to fix critical issues.
- flexd 11mo agono, because if you used dependency cooldown you wouldn't be using the latest version when you start your project, you would be using the one that is <cooldown period> days/versions old edit: but if that's also compromised earlier... \o/
- Ygg2 11mo agoNPM is the largest possible target for such an attack. Attack an important package, and you can get into the Node and Electron ecosystem. That's a huge prize.