SafeEval

Configuring minimum release age across npm, pnpm, yarn, and bun

Setting a minimum release age (a "cooldown") on dependencies is a cheap, high-leverage defense against supply-chain attacks. Most malicious package versions are detected and yanked within hours, so a 24-hour delay filters out the smash-and-grab incidents (axios 1.14.1, ua-parser-js, Solana web3.js, etc.).

All four major Node.js package managers now support this, but each one used a different name and a different unit. Here is what you need.

Minimum versions

Tool	Setting	Unit	Introduced in

SafeEval

Configuring minimum release age across npm, pnpm, and yarn

Setting a minimum release age (a "cooldown") on dependencies is a cheap, high-leverage defense against supply-chain attacks. Most malicious package versions are detected and yanked within hours, so a 24-hour delay filters out the smash-and-grab incidents (axios 1.14.1, ua-parser-js, Solana web3.js, etc.).

All three major Node.js package managers now support this, but each one used a different name and a different unit. Here is what you need.

Minimum versions

Tool	Setting	Unit	Introduced in

SafeEval

#!/bin/bash

# Set CLUSTER_NAME and SERVICE_NAME env vars.

# Get the container task ID.
TASK_ID=$(aws ecs list-tasks \
  --cluster "$CLUSTER_NAME" \
  --desired-status RUNNING \
  --output text \
  --query 'taskArns[0]' | awk -F/ '{print $NF}')

SafeEval

import requests
import csv
import sys
import time

# Optional: Replace with your ipinfo.io token (or use free tier)
IPINFO_TOKEN = ""  # e.g., "123abc456def"

HEADERS = {
    "Authorization": f"Bearer {IPINFO_TOKEN}"

SafeEval

import dspy
from typing import Dict


class PortlandOracle(dspy.Signature):
    """Answer questions about Portland restaurants."""
    question: str = dspy.InputField()
    answer: str = dspy.OutputField()

    def forward(self, question):

SafeEval

import { randomBytes as csprngRandomBytes, scrypt, timingSafeEqual } from 'crypto';
import { promisify } from 'util';

const scryptAsync = promisify(scrypt);

/**
 * Hashes a string using the scrypt algorithm.
 *
 * @param value - The value to hash.
 * @returns A promise that resolves to the hashed value in the format `base64(salt):base64(derivedKey)`.

SafeEval

import { hash, verify, Options, Algorithm } from '@node-rs/argon2';

/**
 * Hashes a string using the Argon2id algorithm.
 * Argon2 is a memory-hard function that requires a large amount of memory to compute.
 * The 'id' variant mixes resistance against both GPU cracking and side-channel attacks.
 * A generated salt value adds resistance against pre-computed rainbow table attacks.
 * The configuration options are included in argon2 hashes to simplify verification.
 *
 * @param value - The value to hash.

SafeEval

#!/bin/bash

OUTFILE="otp-hashes.csv"

function gen_hash() {
  otp=$1;
  hash=$(echo -n $otp | sha256sum | awk '{print $1}');
  echo "$otp,$hash" >> $OUTFILE;
}

SafeEval

#!/bin/bash

curl \
  --header "Authorization: Bearer $TFC_TOKEN" \
  --header "Content-Type: application/vnd.api+json" \
  "https://app.terraform.io/api/v2/account/details"

SafeEval

#!/bin/bash

# Connect a TFC workspace to a Github VCS provider using the TFC API.

INFILE_WORKSPACES="tfc-workspace-name-list.txt"

function check_env() {
	var_name="$1"
	var_value="$2"