NPM's release cooldown is security theater
5 hours ago
- Release cooldowns (e.g., 7 days for npm, 3 days for pnpm) are being adopted as a security measure, but they are ineffective and constitute security theater.
- The assumption that the community will vet packages during the cooldown is flawed: no one is incentivized to be the early adopter, leading to a situation where everyone waits for someone else (waiting for Godot).
- CI/CD pipelines that automatically update packages do not help because malicious code either goes unnoticed or succeeds before detection, and developers often install without scrutiny.
- The recommended solution is to actively scan and audit code (Do Your Own Research) using static analysis tools, sandboxes, HIPS, and LLM-assisted audits before installation.