They definitely wouldn't be if attackers knew that it would then bypass cooldowns!

Ultimately, you need someone to verify releases and that probably means paying for it. I know Sonatype paid solutions utilise their own internal research to allow/block new releases.

No, but there's a bigger tradeoff for not upgrading. In one case it's that you're potentially exposed to a known vulnerability, vs the other case where you might just be missing out on some new or slightly reworked feature.

It’s in the name. They are secure!

But then an attacker marks their malicious release as a critical security update. It's really messy unfortunately.

We need something external that actually checks to see if source code matches built artifacts, and also possibly something Llm based that checks to see if you’re making checked in code vulnerable or directly adding something malicious.

Ask your LLM about "reproducible builds".

Yeah those exist… the trouble being we need something that doesn’t exist

There needs to be a service that does reproducible builds of opensource projects as they sit and publishes results for people to scrape freely.

To be robust itself against attacks, likely 3-4 services.

But then that needs funding to be sustainable … and companies are incredibly cheap. Especially right now. As such… shrug :(

Maybe something as a skill for LLMs to run that actually checks build reproduction from source for a project and all of its dependencies? But then that’s gonna burn some tokens ….

I do this for personal projects … but at work they’ve started rationing tokens… as such… idk?