npm's release cooldown is security theater
- 2026/7/21 · #tech · ~2.5k words · Views: ...
- Due to many ecosystem attack incidents, package managers (and packagers, and managers) are apparently falling in love with cooldowns these days (npm, pnpm, yarn and so on).
- As a result, their upstream registry is time-gated for some 7 days or 24 hours.
Unverified
- 2026/7/21 · #tech · ~2.5k words · Views: ...
- Due to many ecosystem attack incidents, package managers (and packagers, and managers) are apparently falling in love with cooldowns these days (npm, pnpm, yarn and so on).
- As a result, their upstream registry is time-gated for some 7 days or 24 hours.
Sources: Outv