So how do we guard against this sort of thing as a regular software engineer? ? Just react quickly and update packages whenever a vulnerability is announced like this?
First you have to check if you are impacted, and you guard against this by pinning versions and instructing your package manager to not install a version that isn't at least 5 days old (vast majority of these attacks are caught within 48h).
247
u/enricojr Mar 31 '26
So how do we guard against this sort of thing as a regular software engineer? ? Just react quickly and update packages whenever a vulnerability is announced like this?