codeinabox@programming.dev to Programming@programming.devEnglish · 2 days agoEvery dependency you add is a supply chain attack waiting to happenbenhoyt.comexternal-linkmessage-square27linkfedilinkarrow-up1160arrow-down11
arrow-up1159arrow-down1external-linkEvery dependency you add is a supply chain attack waiting to happenbenhoyt.comcodeinabox@programming.dev to Programming@programming.devEnglish · 2 days agomessage-square27linkfedilink
minus-squareEager Eagle@lemmy.worldlinkfedilinkEnglisharrow-up49·2 days ago You should probably turn off Dependabot Nonsense, most of these supply chain attacks are detected and have their problematic versions pulled within a few hours. Just set a cooldown period for dependabot.
Nonsense, most of these supply chain attacks are detected and have their problematic versions pulled within a few hours. Just set a cooldown period for dependabot.
The discovered ones anyway.