Wait 24 Hours Before Updating pip/npm Packages, Say Security Experts
thursdai_pod · x · 2026-10-23
On the ThursdAI podcast, security expert @theJoshMeister argued updates shouldn't be treated equally: browsers, OSes and phones should be patched immediately, but pip and npm packages are safer updated after 24 hours — supply chain attacks like LiteLLM tend to get caught and pulled fast, so waiting lets the poisoned versions get filtered out.
More from Safety
- Theorem Labs formally verified 123 open-source projects with Claude, launches OSS Verify — teortaxesTex · 2026-10-23
- Anthropic used Claude to prove 123 OSS libraries crash-free, with 180M lines of Rocq proofs — inductionheads · 2026-10-23
- Viral cartoon: humans must show 'proof of human' to survive a web of synthetic content — sierracatalina · 2026-10-23
- Researchers call for anti-shredding provisions as AI firms use self-destructing messages — StephenLCasper · 2026-10-23
- 20+ ICLR 2027 submissions self-confess fabricated placeholder results — thegautamkamath · 2026-10-23
- Fired OpenAI safety researchers tell their side in first podcast interview — kevinroose · 2026-10-23