3 ms·
If everybody does that, won't we take 90 days more to detect problems / hacks of npm packages ?
by ttoinou 11mo ago
If everybody does that, won't we take 90 days more to detect problems / hacks of npm packages ?
- lelandbatey 11mo agoNo, cause the folks detecting the problems typically do so by actively scanning new releases (usually security companies do this). Few such problems are detected by people who do a "normal" update and receive compromised code, investigate, and then report the problem. It does happen, but it's not the "usual" way these supply chain attacks are discovered, especially not the really big ones.
- deleted 11mo ago[deleted]
- mikeweiss 11mo agoUmm... Tell me how the most recent supply chain attack was discovered again?