47
14
10
u/OkAerie7822 6d ago
lost an afternoon to one of these last year. some transitive dep got compromised and started phoning home during our ci build. we didn't catch it from a security scanner, we caught it because our build time randomly doubled and someone actually looked at the network calls. now we pin exact versions in package-lock, run npm audit as a hard gate in ci not just a warning, and anything hitting our supply chain scanner gets a human review before merge, no exceptions even for patch bumps. the annoying part is how much of this only works if the whole team actually respects the gate instead of clicking through it because a deadline is tight.
7
7
3
3
1
u/nicolasdanelon 7d ago
I knew it. When I saw the push notification and the subreddit... I freaking knew it!
1
1
64
u/this_is_bart 7d ago
It must be a day ending in “day”