{"id":1930,"date":"2026-06-24T11:35:11","date_gmt":"2026-06-24T03:35:11","guid":{"rendered":"http:\/\/wp.rungobag.cn\/index.php\/2026\/06\/24\/show-hn-depsguard-one-command-to-harden-npm-pnpm-yarn-bun-uv-configs\/"},"modified":"2026-06-24T11:35:11","modified_gmt":"2026-06-24T03:35:11","slug":"show-hn-depsguard-one-command-to-harden-npm-pnpm-yarn-bun-uv-configs","status":"publish","type":"post","link":"https:\/\/wp.rungobag.cn\/index.php\/2026\/06\/24\/show-hn-depsguard-one-command-to-harden-npm-pnpm-yarn-bun-uv-configs\/","title":{"rendered":"Show HN: DepsGuard \u2013 one command to harden NPM\/pnpm\/yarn\/bun\/uv configs"},"content":{"rendered":"<p>I kept seeing every npm\/pnpm\/yarn\/bun\/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are &#8220;controversial&#8221;, they do work. But even if you convince people that they should set cooldowns, it seems many don&#8217;t end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the &#8220;it won&#8217;t happen to me&#8221; syndrome (or &#8220;I&#8217;ll do it later, it&#8230;<\/p>\n<p><a href=\"https:\/\/github.com\/arnica\/depsguard\">\u67e5\u770b\u539f\u6587 \u2192<\/a><\/p>\n<hr>\n<p><small>\u6765\u6e90\uff1aHacker News \u00b7 RSS \u91c7\u96c6<\/small><\/p>\n","protected":false},"excerpt":{"rendered":"<p>I kept seeing every npm\/pnpm\/yarn\/bun\/uv supply chain p [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ai_generated_summary":"","wpai_meta_description":"","footnotes":""},"categories":[7],"tags":[],"class_list":["post-1930","post","type-post","status-publish","format-standard","hentry","category-tech"],"_links":{"self":[{"href":"https:\/\/wp.rungobag.cn\/index.php\/wp-json\/wp\/v2\/posts\/1930","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wp.rungobag.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wp.rungobag.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wp.rungobag.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wp.rungobag.cn\/index.php\/wp-json\/wp\/v2\/comments?post=1930"}],"version-history":[{"count":0,"href":"https:\/\/wp.rungobag.cn\/index.php\/wp-json\/wp\/v2\/posts\/1930\/revisions"}],"wp:attachment":[{"href":"https:\/\/wp.rungobag.cn\/index.php\/wp-json\/wp\/v2\/media?parent=1930"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wp.rungobag.cn\/index.php\/wp-json\/wp\/v2\/categories?post=1930"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wp.rungobag.cn\/index.php\/wp-json\/wp\/v2\/tags?post=1930"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}