Thorben Westerhuys comments

Repositories
Issues
Comments

Results 3 comments of


                                            Thorben Westerhuys

[BUG] <title>Subsequent malware attacks and security issues in the npm supply chain

> Artifactories are also implementing package delay policies such as JFrog have done, a minimum delay before picking up npm packages for publishing. @Lorondos tried finding references to this, do...

(FR): Implement 'minimumReleaseAge' as a security feature (like pnpm added recently)

> It’s convenient I would argue however, the real power comes from devs and more importantly projects being able to set a default policy for everyone working on the project...

(FR): Implement 'minimumReleaseAge' as a security feature (like pnpm added recently)

@omonk plus `--before` or a default for it can not be set in an npmrc/environment variable, right?