There is an autism lottery. Either you're autistic about something totally monetarily useless like sonic speedrunning, or you are autistic about something that makes a fuck ton of money like GPU schedulers
This is why @pnpmjs's latest v11 release was the top story in Socket Weekly this past week - it includes smart defaults that put roadblocks in front of attacks like this.
Hard to imagine a more relevant release for this week’s supply chain chaos. 🔮
https://t.co/IE1l8KhvdB
Everyone is tweeting out "use pnpm & set a minimumReleaseAge of 7 days"
but don't forget blockExoticSubdeps - which would also prevent the usage of a remote github reference here!
Launch rehearsal complete. During a flight-like countdown, more than 5,000 metric tonnes (11+ million pounds) of propellant were loaded on the fully stacked Starship and Super Heavy V3 vehicles for the first time
Our biggest breakthrough in efficiency yet, the Framework Laptop 13 Pro with 20 hours of battery life. In Graphite.
Linux-first with options for Ubuntu pre-installed. Featuring Intel® Core™ Ultra Series 3 processors, LPCAMM2 Memory, a new haptic touchpad, and a touchscreen display.
Pre-orders for the Framework Laptop 13 Pro open now: https://t.co/88vOj9duM1
New supply chain attack this time for npm axios, the most popular HTTP client library with 300M weekly downloads.
Scanning my system I found a use imported from googleworkspace/cli from a few days ago when I was experimenting with gmail/gcal cli. The installed version (luckily) resolved to an unaffected 1.13.5, but the project dependency is not pinned, meaning that if I did this earlier today the code would have resolved to latest and I'd be pwned.
It's possible to personally defend against these to some extent with local settings e.g. release-age constraints, or containers or etc, but I think ultimately the defaults of package management projects (pip, npm etc) have to change so that a single infection (usually luckily fairly temporary in nature due to security scanning) does not spread through users at random and at scale via unpinned dependencies.
More comprehensive article:
https://t.co/EJAZbqAPIQ