Nothing Installs Until It's a Week Old: a 7-Day npm Cooldown

A developer describes implementing a seven-day cooldown proxy for public package registries like npm and PyPI to mitigate software supply-chain attacks. The proxy intercepts downloads, hides versions newer than a week to allow the community time to discover malicious packages, and maintains a download log and blocklist. Open article →