Hacker News
new
|
past
|
comments
|
ask
|
show
|
jobs
|
submit
login
davidpfarrell
on Sept 18, 2025
|
parent
|
context
|
favorite
| on:
Pnpm has a new setting to stave off supply chain a...
Wow so couldn't said security co's establish their own registry that we could point to instead and packages would only get updated after they reviewed and approved them?
I mean I'd prolly be okay paying yearly fee for access to such a registry.
davidshepherd7
on Sept 19, 2025
|
next
[–]
IIUC chainguard is this, but only for python, java, and docker images so far.
https://www.chainguard.dev/libraries
getcrunk
on Sept 19, 2025
|
prev
[–]
I think it would be a no brainer for npm to offer this but idk why they haven’t
phatfish
on Sept 19, 2025
|
parent
[–]
Probably because they would expose themselves legally? Not sure what the current situation is exactly, but I assume it's "at your own risk".
Guidelines
|
FAQ
|
Lists
|
API
|
Security
|
Legal
|
Apply to YC
|
Contact
Search:
I mean I'd prolly be okay paying yearly fee for access to such a registry.