←back to thread

Malicious versions of Nx and some supporting plugins were published

(github.com)
441 points longcat | 1 comments | 27 Aug 25 01:38 UTC | HN request time: 0.241s | source
Show context
andix ◴[27 Aug 25 18:59 UTC] No.45043591[source]▶
Are there any package managers that have something like a min-age setting. To ignore all packages that were published less than 24 or 36 hours ago?

I’ve run into similar issues before, some package update that broke everything, only to get pulled/patched a few hours later.

replies(5): >>45043774 #>>45043852 #>>45045196 #>>45045198 #>>45047987 #
1. bapak ◴[28 Aug 25 03:18 UTC] No.45047987[source]▶
npm install actually has a flag to install dependencies as they appeared on a specific point in time. This flag is applied to the entire tree.

What this means is that you can run "npm instal --before (date for 2 days ago)" and it will skip any dependencies newer than that.