3 ms·
Everyone needs to switch to pnpm and enable https://pnpm.io/settings#minimumreleaseage https://pnpm.io/settings#minimumreleaseage Pnpm also blocks preinstall s
by kaelwd 11mo ago
Everyone needs to switch to pnpm and enable https://pnpm.io/settings#minimumreleaseage https://pnpm.io/settings#minimumreleaseage
Pnpm also blocks preinstall scripts by default.
- thepill 11mo agoOr bun
- loloquwowndueo 11mo agoNah - dependency cooldown is all the rage but it’s only effective if you have some noncompliant canary users. Once everyone is using it it will cease to be effective because nobody will be taking the first step/risk until everybody does.
- moebrowne 11mo agoThe point of the cooldown is to allow time for vendor scans to complete and for compromised packages to be pulled. It's not about waiting for an end user to notice they've been compromised. > Meanwhile, the aforementioned vendors are scanning public indices as well as customer repositories for signs of compromise, and provide alerts upstream (e.g. to PyPI). https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns https://blog.yossarian.net/2025/11/21/We-should-all-be-using...
- loloquwowndueo 11mo agoDepending on “security vendors” to do scans of every single update seems naive and over optimistic to me, but hey - everyone’s jumping on the bandwagon regardless of what I think so I guess we’ll see soon.
- limaho 11mo agoDon't "security venders" detect and report most of these types of attacks already today?
- loloquwowndueo 11mo agoDo they? :)
- moebrowne 11mo agoWhat's the alternative?