logoalt Hacker News

frodddtoday at 6:00 AM2 repliesview on HN

This is exactly how developers of malware want you to behave. Update without really thinking about it.

I do wonder how long it will take before an attack is developed by submitting a semi-genuine vulnerability, shortly followed by a ‘fix’ including malicious code.


Replies

capitol_today at 9:13 AM

The cooldown setting in dependabot solves this attack vector. By setting it you give security vendors time to scan new packages.

KptMarchewatoday at 8:30 AM

Dependency cooldowns fix most of those problems.