Package Managers need global hooks ⚓
Summary
A personal blog post proposing that all package managers implement global hooks to enforce security policies. It discusses current mitigation approaches (cooldowns, policies, and firewall-like protections), limitations of per-workspace hooks, and a proof-of-concept using a threat feed to illustrate how global hooks could pre-empt malicious installs. The piece advocates for global hooks as a scalable defense across ecosystems like pnpm, npm, Yarn, and AUR helpers.