3 ms·
> comes out to ~$200 in tokens every time BTW a curated mirror of <whatever ecosystem> packages, where every package is guaranteed to have been analyzed and te
by nine_k 6mo ago
> comes out to ~$200 in tokens every time
BTW a curated mirror of <whatever ecosystem> packages, where every package is guaranteed to have been analyzed and tested, could be an easy sell now. Also relatively easy to create, with the help of AI. A $200 every time is less pleasant than, say, $100/mo for the entire org.
Docker does something vaguely similar for Docker images, for free though.
- AgentME 6mo agoPeople are already scanning npm constantly. You can limit yourself to pre-scanned packages by setting npm's minimum release age setting to 1 or 2 days (a timeframe that all the recent high-profile malicious package versions were unpublished within).
- nine_k 6mo agoNote to self: the test suite for vetting a package should include setting the system date some time in the future, to check if an exploit is trying to sleep long enough to defeat the age limit.
- chickensong 6mo agohttps://www.chainguard.dev/ https://www.chainguard.dev/