Comment by vldszn
3 hours ago
friendly reminder:
- disable auto-updates for extensions in VS Code/Cursor
- use static analysis for GitHub Actions to catch security issues in pre-commit hook and on ci: https://github.com/zizmorcore/zizmor
- set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security
- for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e...
- add Socket Free Firewall when installing npm packages on CI to catch malware https://docs.socket.dev/docs/socket-firewall-free#github-act...
friendly reminder: use vim :)
If you are a person that installs extensions from public sources, it doesn't matter what IDE you use.
If you don't (or can't) install extensions, it also doesn't matter which IDE you use.
It honestly surprises me we don't hear news about vim/neovim plugin supply chain attacks.
probably a much smaller dependency graph (lesser usage of transitive dependencies)
=)