Post #2522225

@xgebi@hachyderm.io dependabot lets you set a minimum age of a dependency before a PR is raised, something like 7+ days old apparently protects against these attacks affecting you -by then it's already surfaced and the malware blocker will be at work. Key: never be in a rush to update your NPM dependencies. If you must use NPM #cybersecurity