Organizations urged to enforce npm dependency cooldowns centrally

The author argues that while open-source ecosystems are adopting release cooldown settings to mitigate software supply chain attacks, client-side configurations are inconsistent, voluntary, and easily bypassed by developers or AI coding agents. To reliably block malicious packages, organizations must enforce dependency cooldowns centrally on the wire within the network request path before artifacts ever land on disk or inside container clusters. Open article →