[clbrmbr]

Re: updates: I was just thinking of waiting a few weeks on the updates to allow compromised packages to be discovered.

[naugtur]

socket.dev will find most malware within hours of it being published.

with LavaMoat most malware won't work even if you don't detect it.