Unverified50% confidenceFactExact time

Bumply 在执行更新前对项目的 package.json 和 lockfile 进行逐字节（byte-for-byte）备份，并在更新失败时立即回滚

1

Sources

50%

Confidence

Medium-term (~90 days)

Relevance

8/26/2026

First Seen

Valid until: 11/24/2026

Sources

Bumply: A Mac Dependency Update Manager with One-Click Rollback

Related Entities

Related Claims

Unverified版本锁定文件（package-lock.json或yarn.lock）无法完全阻断供应链攻击，因为新建项目首次安装仍会拉取被污染版本，且自动化更新工具可能升级至恶意版本65% similar Unverifiedshadcn/ui 采用「复制代码到本地」而非「npm包依赖」的分发模式，消除了版本锁定问题59% similar UnverifiedThe RoPE bug has been fixed and the corresponding code update has been committed.56% similar

Cite This Claim

Stable URI

https://kongchang.com/claim/802972

API

curl https://kongchang.com/api/v1/knowledge/claims/802972

MCP

get_claim(id=802972)