Package Manager Trends
Sixteen-week roundup finds package managers converging on release-age cooldowns, install-script blocking, malware scans, and recurring path-traversal and credential-leak fixes.
The author aggregates supply-chain security trends from sixteen weeks of This Week in Package Management, built from about 80 RSS feeds. Release-age cooldown gates shipped in Deno 2.8, Bundler, npm, Yarn, mise, Hex, Mamba, and Cargo, with Dependabot making a three-day cooldown default in August. npm 12 and Bun 1.4 now block lifecycle install scripts by default, and Composer 2.10 and uv added install/publish-time malware checks, while npm's registry began scanning at publish time. Path traversal on archive extraction was fixed in 14 of 16 weeks across tools including uv, pnpm, Docker, and Composer, and credential-misdirection bugs affected Cargo, ORAS, Composer, and Renovate.
- Release-age cooldown gates now ship across npm, Cargo, Hex, and Dependabot with advisory-driven overrides.
- npm 12 blocks lifecycle install scripts by default; pnpm 12 errors on unrecognized config keys.
- Five tools added built-in audit commands, including deno audit fix, uv audit, and brew vulns.
- Registry-side controls tightened at npm, Packagist, PyPI, NuGet.org, and AUR after takeover incidents.
- Alpha-Omega and the Sovereign Tech Agency funded maintainer security work in PHP, Ruby, and Flatpak ecosystems.
- Vendors
- DependabotRenovate
- Organizations
- Alpha-OmegaSovereign Tech Agency
From the original article
4 min read at nesbitt.io
I’m on holiday this week, so I’m phoning it in and doing a roundup of the trends I’ve seen across sixteen weeks of This Week in Package Management . Those posts are built from about eighty RSS feeds and whatever I’ve boosted on Mastodon. The short version: the same defensive features keep shipping in tool after tool, and the same three bug classes keep getting fixed.
By nesbitt.io via hugoarnal · nesbitt.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.