On: NPM package ‘ua-parser-JS’ with more than 7M weekl...

[8organicbits]

I imagined an optional delay for npm install/update. That way it would only slow down users who wanted more time.

[okhobb → 8organicbits]

Got it. Yea I agree that's useful and easy mitigation, and I'm sure enterprise users would certainly pay for other safety labeling/filtering/signing of packages.

[alienalp → 8organicbits]

It makes so much sense, surprised me that it doesn't exist.