If I had to bet, the most likely and pragmatic solution will be to have dependen... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

jimbohn 8 months ago | parent | context | favorite | on: Shai-Hulud Returns: Over 300 NPM Packages Infected

If I had to bet, the most likely and pragmatic solution will be to have dependencies cooldown and that's it

creata 8 months ago [–]

If everyone does it, then it becomes less effective, because there'd be fewer early testers to experience and report issues, no?

jimbohn 8 months ago | [–]

Yes, it's gonna be heuristics all way down. This problem isn't solved formally but the ecosystem(s) having these issues are too big to be discarded "just" because of that.

Consider applying for YC's Fall 2026 batch! Applications are open till July 27.
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact