If you’re looking for ways to reduce the risk from compromised #NPM packages, here’s a solid post from Hacker News. I contains a few practical steps to harden your setup: - Use pnpm. It’s faster, takes less space, and blocks post-install scripts by default. Most of them are useless or shady anyway. - Set minimumReleaseAge to delay fresh packages. In recent attacks, that delay alone would’ve been enough to avoid pulling malicious versions. - On Linux, wrap your package manager in bubblewrap. Keeps the junk from touching sensitive files like ~/.ssh No tools to buy. No pipelines to rebuild. Just small changes that help. Hacker News post: news.ycombinator.com/item?id=452743… Config: #minimumreleaseage" target="_blank" rel="nofollow noopener">pnpm.io/settings#minim…
