marketplace.visualstudio.com
Show HN: A VS Code extension buffers NPM updates to avoid supply chain attackshttps://marketplace.visualstudio.com/items?itemName=about14sheep.tinynpmI had been using package.json version keepers for quite some time but after the big supply chain attack i thought they would be the perfect place to add in some security.The idea is just to provide the latest package number x days old. This will help prevent most of the danger in supply in chain attacks.It will also remove the `^` if you have it so you can better control what version of a package your application is using.To be more security focused it gives general hints in the hover menu to help keep an eye on the packages you have installed. These hints include warnings for staleness, high dependency count, and number of downloads.Since all of this is something you can get through the npm api, I called it tinyNpmJul 30, 2026 11:57 PM
