codeinabox@programming.dev to Programming@programming.devEnglish · 5 months agoEvery dependency you add is a supply chain attack waiting to happenbenhoyt.comexternal-linkmessage-square14linkfedilinkarrow-up15arrow-down10cross-posted to: lobsters@lemmy.bestiver.se
arrow-up15arrow-down1external-linkEvery dependency you add is a supply chain attack waiting to happenbenhoyt.comcodeinabox@programming.dev to Programming@programming.devEnglish · 5 months agomessage-square14linkfedilinkcross-posted to: lobsters@lemmy.bestiver.se
minus-squareEager Eagle@lemmy.worldlinkfedilinkEnglisharrow-up1·5 months ago You should probably turn off Dependabot Nonsense, most of these supply chain attacks are detected and have their problematic versions pulled within a few hours. Just set a cooldown period for dependabot.
Nonsense, most of these supply chain attacks are detected and have their problematic versions pulled within a few hours. Just set a cooldown period for dependabot.
The discovered ones anyway.