News for hackers. Stuff that matters.

A comment on NPM packages from Red Hat have been compromised. Parent comment

Re:NPM packages from Red Hat have been compromised by j1elo on Monday June 01, 2026 @11:47AM (#48358468)
What is being said is that a new flag like '--minimum-release-age' would take, realistically speaking, tops 4 hours to implement (without AI assistance), plus a good 1 week of thorough testing, and maybe a 1 month period of progressive deployment. Come on, let's give it a total of 1.5 months, for good measure.

Of course this should have been started since the beginning of the major recent stream of supply chain attacks, circa 2024 or 2025... but even assuming the most backwards calendaring possible -starting after the last bug compromise (Axios, on March 31st)- that new flag should have already been shipped a couple weeks ago.

Shit does take time, but where there's a will there's a way, and nobody buys that this shit would take that much time.

[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by insanitybit on Monday June 01, 2026 @12:21PM (#48358943)
Have you ever managed software as critical and ubiquitous as npm?
[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by j1elo on Monday June 01, 2026 @01:02PM (#48359530)
Not infra, but final product. I know, corporations move slow. But when there is a critical issue, and an actual desire to solve it from someone in a suit, suddenly turns out that the cogs were always able to speed up and move fast...
[ Parent | on HN ]