Minimum release age for @latest
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 3.8k
- Forks
- 279
- Avg merge
- 1h 47m
- Merged PRs (30d)
- 2
Description
When running for example corepack prepare pnpm@latest --activate the corepack will apparently install the latest tag even if it was created just minutes ago. In case the package manager is compromised and a malicious version of it is published, corepack users might get it installed if their timing is unlucky.
Would it make sense for corepack to support something like minReleaseAge to give security researchers time to detect compromised versions?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing corepack prepare pnpm@latest --activate and tracing how the @latest tag is resolved. Define the expected behavior for a proposed minReleaseAge setting and verify that recently published versions are excluded while older versions remain eligible.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nodejs, typescript
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100