Skip to content

.tip

· one of the small things

Do not install a package published this week

Poisoned versions sat on the registry for anywhere from hours to a couple of days before they were pulled. With a minimum age, your lockfile never points at one.

# .npmrc (pnpm)
minimum-release-age=4320

Three days costs you nothing on stable packages. On the day you need a security fix sooner, override it for that one package.

securitynpm

Longer version: the post this came from.