Boring Supply-Chain Defense
Kevin's stance on supply-chain security: the real defense is boring toolchain discipline, not exotic tooling. Pin the lockfile, quarantine new releases, and treat install hooks as hostile - that's most of the win.
Where npm Supply Chain Security is the factual taxonomy of the TeamPCP/Shai-Hulud waves, this is Kevin's priority stack and voice on it: don't theatrically over-engineer security when the cheap, boring controls do the heavy lifting. Source: Cursor transcript, kevin-wiki, 2026-05
The priority stack
pnpm+ frozen lockfile. Deterministic installs; no surprise version drift.minimumReleaseAge(e.g. 10080 minutes = 7 days). Quarantine brand-new releases so a compromised version is usually yanked before you ever install it.- That's most of it. Kevin's framing is deliberately nonchalant: "my whole supply chain defense is boring." Source: Cursor transcript, kevin-wiki, 2026-05
The optional layer
Agent-specific hardening - Brin pre-scanning installs, and treating
postinstall scripts and .claude/ settings as hostile - is real and worth doing, but it's the
optional layer, not the headline. The headline is the boring stuff. Source: Cursor transcript, kevin-wiki, 2026-05
Why it matters
It's a first-hand, low-drama take: most supply-chain risk is retired by a frozen lockfile and a release-age window, so spend the security budget there before reaching for anything exotic. The contribution here is the prioritization and tone, which the factual page deliberately doesn't carry.
Timeline
- 2026-05-31 | Page created from the kevin-wiki supply-chain content session. Captured Kevin's "boring defense" priority stack (pnpm + frozen lockfile + minimumReleaseAge) and the optional Brin/hostile-hooks layer. Source: Cursor transcript, kevin-wiki, 2026-05