🟠 High | Source: AWS Security Blog
The first hours after a new npm or PyPI package is published represent a critical window of risk, as security scanners cannot analyse packages before they go live. Recent supply chain attacks targeting Node.js and Python ecosystems were detected and removed within hours, but users who updated during that window were exposed. This post from AWS outlines how to harden Amazon Linux environments against such transient threats.
Security Architect’s Take: Implement package version pinning and integrity verification (lockfiles, hashes) in your Amazon Linux build pipelines, and consider introducing a time-delay or private mirror policy so your environments never pull packages within the first few hours of publication. Pair this with runtime monitoring to catch post-install malicious behaviour.
Original advisory: Secure your npm and pip package updates in Amazon Linux