Secure your npm and pip package updates in Amazon Linux

Key Takeaways

• If you use and install packages from npm or PyPI, the first hours after a package is published are the riskiest because scanners can’t analyze package.
• Recent supply chain events affecting NodeJS and Python packages have been detected and removed within hours.
• However, while those packages were available to the general public, it’s possible that they were installed by users, creating the potential for a secu.