meanwhile pnpm 10.x by default won't donwload packages younger than a day
Staged publishing and new install-time controls for npm
11–17 of 17 posts
Re: Staged publishing and new install-time controls for npm
#12meanwhile pnpm 10.x by default won't donwload packages younger than a day
Is one day enough to find vulnerabilities? Who keeps an eye on new releases? Otherwise the problem continues to exist, just delayed by one day.
Re: Staged publishing and new install-time controls for npm
#13meanwhile pnpm 10.x by default won't donwload packages younger than a day
Is one day enough to find vulnerabilities? Who keeps an eye on new releases? Otherwise the problem continues to exist, just delayed by one day.
There’s almost a dozen cybersecurity companies scanning NPM publishes in real-time and analysing them.
Re: Staged publishing and new install-time controls for npm
#14meanwhile pnpm 10.x by default won't donwload packages younger than a day
*11.x
Re: Staged publishing and new install-time controls for npm
#15Perfect, now we'll start seeing people automate auto publishing because they don't want to explicitly push a button to publish it.
Re: Staged publishing and new install-time controls for npm
#16Is any form of code analysis out of the question? Static and dynamic analysis of the code would seem like a promising idea rather than just trying to defer the update and hence the problem.
[dead]