|
|
|
|
|
|
by 0xbadcafebee
14 days ago
|
|
|
> Dependabot now waits until a new release has been available on its registry for at least three days before opening a version update pull request So you exploit on Tuesday 12pm, dependabot opens a PR on Friday 12pm, people merge it, and your trojan's timer is set to go off over the weekend when nobody is patching. |
|
|