codeinabox@programming.dev to Programming@programming.devEnglish · 2 days agoEvery dependency you add is a supply chain attack waiting to happenbenhoyt.comexternal-linkmessage-square23fedilinkarrow-up1155
arrow-up1155external-linkEvery dependency you add is a supply chain attack waiting to happenbenhoyt.comcodeinabox@programming.dev to Programming@programming.devEnglish · 2 days agomessage-square23fedilink
minus-squareEager Eagle@lemmy.worldlinkfedilinkEnglisharrow-up49·2 days ago You should probably turn off Dependabot Nonsense, most of these supply chain attacks are detected and have their problematic versions pulled within a few hours. Just set a cooldown period for dependabot.
Nonsense, most of these supply chain attacks are detected and have their problematic versions pulled within a few hours. Just set a cooldown period for dependabot.
The discovered ones anyway.