[AgentME]

Another supply chain attack found and blocked in a day. Everyone regularly using npm to install new packages should be using npm's min-release-age setting to avoid package versions that are newer than a few days old to avoid most attacks in practice like this. You can set it to two days with `npm config set min-release-age=2` for example. https://cooldowns.dev/ has info about equivalent settings in other dependency managers like PyPI and Cargo.

[sevenzero]

Or just use dependencies from 6 years ago and never update them like most companies i ever worked for.

[halfcat]

Accidental true leadership