chokidar-cli package hijacking pending?

(github.com)

2 points | by dwoldrich 9 hours ago

2 comments

  • dwoldrich 9 hours ago
    According to https://www.npmjs.com/package/chokidar-cli, current version is 3.0.0, last released 4 years ago, so should be good to pin that version and look for alternatives at your leisure.

    https://github.com/open-npm-tools/chokidar-cli is the new listed homepage, which tipped me off there was a looming problem. It was created a week ago and has not yet released any new versions, but obviously the account has control over the package in NPM.

    • dwoldrich 9 hours ago
      Friendly reminder to pin all the versions and then let GitHub Dependabot, ActiveState or Synk tell you when you should upgrade.