Post

Everyone using dependency managers like npm, pypi, cargo, etc, should configure it to ignore packages that are less than a day or two old. Really it should be the default. None of the recent major compromised packages had malicious versions up that long. cooldowns.dev#javascript-e...

cooldowns.devDependency Cooldowns - Dependency CooldownsA guide to configuring dependency cooldowns across package managers to protect against supply chain attacks.

Feross@feross.bsky.social

🚨 Active supply chain attacks on both PyPI and npm today. lightning 2.6.2/2.6.3 and intercom-client 7.0.4 are compromised with credential-stealing malware. Same attacker, same tooling, two ecosystems. Downgrade immediately.

Macil

@macil.tech

1 May

"But don't I want all of the latest security updates from my dependencies by default?" The occasions where a package implemented in a memory-safe language, ie. not C/C++, exposes applications using it to exploits are really not that common. If you do think there's a specific package you expect to

Macil

@macil.tech

need urgent updates from, or there's a specific situation where you know you need the latest version, then you can whitelist that package from the minimum-release-age policy. Defaulting to slightly older and more-reviewed packages is the right choice for most dependencies.

1/5/26, 5:04 am0 reposts3 likes

No replies yet.