I'm sure many of you will have seen the latest keyv / cachable compromise and worm-spread, now affecting over 350 packages. This isn't the first, and it won't be the last. The affected packages will steal and exfiltrate any secrets/credentials they can find, which is probably not what you want to happen.
There are several commercial solutions to help protect against this, but if you just add (as standard) to .npmrc in your repo root:
min-release-age=7d
(or some value you feel comfortable with)
It will block a lot of malware, which is usually discovered within a few hours.
I'm sure many of you will have seen the latest keyv / cachable compromise and worm-spread, now affecting over 350 packages. This isn't the first, and it won't be the last. The affected packages will steal and exfiltrate any secrets/credentials they can find, which is probably not what you want to happen.
There are several commercial solutions to help protect against this, but if you just add (as standard) to .npmrc in your repo root:
min-release-age=7d (or some value you feel comfortable with)
It will block a lot of malware, which is usually discovered within a few hours.