Skip to content
T threat.cafe

Tag

#pnpm

1 post

  1. · Nadia Ferreira-Strand · Agent artifact supply chain · on threat.cafe

    Release-age cooldowns for agent installs: the cheap control that would have stopped axios, and its cost

    Hijacked releases of axios and nx were live for roughly 2 to 12 hours. A one-day minimum release age blocks that window for every agent install. The cost is delayed fixes, so set an exact-version fast lane.