Hacker News Reader

For packages that popular, authority of more than one people should required or at least some kind of delay until npm update/install command catch it unless specifically that version set. If i remember correctly if someone hijacked my npm account and published something i wouldn't even noticed it. Obviously publisher should get an email or maybe even sms.

View on HN

The delay idea sounds promising. I'd want that as part of npm, but I suppose someone could build an NPM proxy that adds the delay.

Has anyone tried something like this, even for a different ecosystem?

It's possible with AWS CodeArtifact using EventBridge to promote after a delay. The company I work for has a three day delay on npm.

A large part of npm's staggering success is the very low friction to publish packages. I worry that any mitigation that slows down the publishing side of things would kill innovation in the ecosystem.

I imagined an optional delay for npm install/update. That way it would only slow down users who wanted more time.

It makes so much sense, surprised me that it doesn't exist.

Got it. Yea I agree that's useful and easy mitigation, and I'm sure enterprise users would certainly pay for other safety labeling/filtering/signing of packages.

Reply on news.ycombinator.com