Skip to content
BoringStack
GitHub

Supply-chain protection

3 min read

Supply chain

Supply-chain attacks follow a predictable timeline: a maintainer’s account is compromised, a malicious version is published, the community detects and yanks it within hours to days. The undetected window is short but exploitable. Every BoringStack repo enforces a seven-day minimum release age to block installs inside that window.

How it worksOverriding

7 days

minimum release age

All repos

enforced uniformly

Zero config

to activate

Attack window

Hours to days

Malicious versions typically get yanked within 24–72 hours of detection.

Our gate

7-day hold

Packages younger than 7 days won't install. The window closes before the gate opens.

Detection

Community signal

OSV scanner, npm audit, and human review all have time to flag the package before it lands.

How it works per package manager

Section titled “How it works per package manager”
apps/api (Bun)

bunfig.toml: [install] minimumReleaseAge = 604800 (seconds).

apps/ui (Bun)

bunfig.toml: [install] minimumReleaseAge = 604800 (seconds), with per-package excludes for high-churn and first-party packages.

apps/docs (Bun)

bunfig.toml: [install] minimumReleaseAge = 604800 (seconds).

infra/compose

No JS deps; n/a.

infra/bootstrap

No JS deps; n/a.

Trade-offs

Section titled “Trade-offs”
First-time installs may fail when the range resolves to a brand-new release

Pin to a specific older version or wait.

Critical security patches are delayed seven days

Override per-package via Bun/npmrc exclusions when a real CVE drops.

Slightly behind the bleeding edge

This is the point.

Overriding for a specific package

Section titled “Overriding for a specific package”

Bun supports per-package overrides in bunfig.toml via minimumReleaseAgeExcludes:

minimumReleaseAgeExcludes = [
  "yaml",
  "@tailwindcss/oxide*",
]

Glob patterns are supported, useful for platform-variant packages like @tailwindcss/oxide-*.

Why not just trust npm?

Section titled “Why not just trust npm?”

npm’s audit signal lags detection. By the time npm audit reports a malicious version, the attack window has closed. This rule does not replace audits. It is a low-cost, independent layer that extends the detection window for those tools.

References

Section titled “References”
Section titled “Related”