Hacker News
new
|
past
|
comments
|
ask
|
show
|
jobs
|
submit
login
AndreasHae
10 months ago
|
parent
|
context
|
favorite
| on:
Shai-Hulud malware attack: Tinycolor and over 40 N...
It’s still ridiculous to me that version pinning isn’t the default for npm.
The first thing I do for all of my projects is adding a .npmrc with save-exact=true
silverwind
10 months ago
[–]
save-exact is mostly useless against such attacks because it only works on direct dependencies.
electrotype
10 months ago
|
parent
[–]
Why, though?
Consider applying for YC's Fall 2026 batch!
Applications
are open till July 27.
Guidelines
|
FAQ
|
Lists
|
API
|
Security
|
Legal
|
Apply to YC
|
Contact
Search:
The first thing I do for all of my projects is adding a .npmrc with save-exact=true