For recent attacks, I've been using pnpm's minimumReleaseAge=10080 (minutes) or npm's min-release-age=7 (days, v11.10+) or bun's minimumReleaseAge=604800 (seconds). It's a very practical and effective defense against npm supply chain attacks.
Viking(@vikingmute)357 字 (约 2 分钟)
70
Viking recommends using the package version cooling mechanism provided by pnpm, npm, or bun to defend against npm supply chain attacks, ensuring that newly released packages must cool down for a certain period before being installed, thus avoiding attack windows.
入选理由：pnpm、npm 和 bun 提供了包版本冷却机制，分别设置为 10080 分钟、7 天和 604800 秒。
FeaturedTweet#npm#supply chain attack#security#package manager中文