Minimum Release Age Is an Underrated Supply Chain Defense, by @daniakash.com:

https://daniakash.com/posts/simplest-supply-chain-defense/

#security #dependencies #npm #bun #pnpm #yarn #deno #renovate #dependabot #axios

Minimum Release Age is an Underrated Supply Chain Defense | Dani Akash

A 7-day package delay would have blocked installs in most short-lived malicious publish attacks from the last 8 years