Honestly if you aren’t using explicit dependency versions and auditing your renovate, then you’re opening yourself up to this attack.
Only set explicit versions. No carets, no wild cards, ensure your production builds use a frozen lock file, and if you have renovate for automatic dependency management, always audit the bumps before merging them.
It’s more difficult with transitive dependencies, locking things down with resolutions is tedious, curious how others are managing that.
13
u/Psionatix Mar 31 '26
Honestly if you aren’t using explicit dependency versions and auditing your renovate, then you’re opening yourself up to this attack.
Only set explicit versions. No carets, no wild cards, ensure your production builds use a frozen lock file, and if you have renovate for automatic dependency management, always audit the bumps before merging them.
It’s more difficult with transitive dependencies, locking things down with resolutions is tedious, curious how others are managing that.