These attackes keep on happening and they're all on you!

Asayer's platform is  dedicated to providing insights and resources for developers and DevOps teams, focusing on web application monitoring, session replay, and error tracking. Through articles, tutorials, and case studies, Asayer offers insights into visualizing user sessions, reproducing bugs, and optimizing user experiences. Developers and QA engineers can learn about monitoring user interactions, detecting UI/UX issues, and improving web application performance and reliability.

asayer

Another Npm Package Is Highjacked and It's Your Fault That This Happened

A simple solution for a very complex problem

“we’re a mess when it comes to dependency management”.

Easy fix with 2 steps: 1. Use lock file. 2. Run in your ci ONLY “yarn install --frozen-lockfile” or “npm ci” (regular install updates the lock files)
Note: Make sure to update your dependencies  regularly, you will only gain from it.
You can use tools like “pleb”, it that will do it for you automatically.

What about security fixes? Isn’t that one of the main reasons for semver (getting security fixes without breaking changes) ?