Dependency Cooldowns: Make Your Package Manager Wait Before It Trusts New Code
Most npm supply-chain attacks follow the same script. Someone phishes a maintainer or steals a publish token, pushes a poisoned patch release, and then waits for every ^1.2.3 range on the planet to pick it up on the next install. The malicious version usually gets spotted and pulled within hours. The damage is done in those hours, by machines that installed it before anyone noticed. A dependency…
npm supply-chain attacks often rely on stealing a publish token or phishing a maintainer to push a malicious patch release, which can then go undetected as many package managers install new versions quickly. Dependency cooldowns aim to address this by forcing package managers to wait before accepting new code. Different tools handle this concept differently, with config keys and units of time varying. pnpm uses minutes, npm uses days by default but can be set in seconds, Bun uses seconds, and Yarn Berry uses minutes.
The key setting is simple, but the nuances can lead to surprises, particularly with transitive dependencies and strict vs. fallback modes. When a cooldown is active, old versions must exist for a certain period before being accepted, helping to prevent rapid installation of compromised versions. However, there are edge cases to consider, like how the gate applies to the entire dependency tree, how lockfiles behave, and how missing timestamps can pass by default.
Teams must also be cautious of false positives, such as npm lying about the cooldown in certain situations. The main takeaway is that setting up a cooldown is a straightforward line of code, but understanding the specifics of each package manager and managing edge cases is crucial for effective security.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
