codeinabox@programming.dev to Programming@programming.devEnglish · 29 days agoEvery dependency you add is a supply chain attack waiting to happenbenhoyt.comexternal-linkmessage-square30linkfedilinkarrow-up1170arrow-down11cross-posted to: [email protected]
arrow-up1169arrow-down1external-linkEvery dependency you add is a supply chain attack waiting to happenbenhoyt.comcodeinabox@programming.dev to Programming@programming.devEnglish · 29 days agomessage-square30linkfedilinkcross-posted to: [email protected]
minus-squareEager Eagle@lemmy.worldlinkfedilinkEnglisharrow-up52·29 days ago You should probably turn off Dependabot Nonsense, most of these supply chain attacks are detected and have their problematic versions pulled within a few hours. Just set a cooldown period for dependabot.
Nonsense, most of these supply chain attacks are detected and have their problematic versions pulled within a few hours. Just set a cooldown period for dependabot.
The discovered ones anyway.