[RRFC] Proposal: set min-release-age default to 7 days.

[mhoye]

Hello, NPM community; I would like to propose that the default of "min-release-age" be set to seven days.

Per https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns the great majority of compromised/malicious NPM packages are detected and remediated within hours or a small number of days. There are a number of examples of this, most recently the cline2.3 injection attack - see: GHSA-9ppg-jx86-fqw7
and: https://grith.ai/blog/clinejection-when-your-ai-tool-installs-another ) - but it is a recurring issue in the NPM ecosystem.

I believe that defaulting min-release-age to one week - which the data suggests would be an effective safety margin - would mitigate a great deal of ecosystem risk at negligible cost.

Anyone wanting to accept that risk would be able to set min-release-age to whatever they want, obviously, and in extremis - say, to pull a fix for a long-deployed but only recently discovered bug - could be dialled to zero, but I believe safe defaults are always good decision.

Thanks for hearing me out.

[ljharb]

One day is more than enough for all but the most paranoid.

[mlevison]

Apparentlty, I'm considered paranoid.

I think a week is a good default.

A small tweak to the original proposal: Start with one week, monitor how long it takes on average to catch vulnerabilities, then adjust the default.

Clearly the current state of affairs is not safe.

[ljharb]

To clarify: my comment is already based on how long on average it takes to catch and take down vulnerabilities, which is a matter of hours. You could set it to a half day and it'd be enough.

[mlevison]

The threat landscape is changing, greater caution is cheap. Here is the scenario, I fear. I'm a part developer, I only work on my apps a few hours a week. If I run an update/upgrade at the wrong moment, I get hit with a vulnerability. ... and I won’t know about it for days/weeks.

As it stands, I fear running an update/upgrade at all.

[ljharb]

and, based on empiric data, if you set a cooldown period of even a single day, that will never happen.

[0x73746F66]

Consider the absurdity of this a moment please?

A retailer learns that organized crews are hitting its stores a full week before the police are even told the pattern exists. The retailer announces its response. It will not review its own security footage for the first seven days after it hears about a theft ring, because the police might identify the crews and send over their photos. The absurdity lands instantly. The police may help. The police may not. Either way the retailer is choosing not to use the cameras it already owns during the exact window when the criminals are most active.

That is a cooldown.

The cameras are detection. The criminals are the same in the scenario as those that are exploiting half of all vulnerabilities published for 7 days BEFORE they are published. Cooldowns are pretending it's not happening.

Where everyone parrotting cooldowns accross the industry should focus energy - is at publication time scanning.
If it is supposedly already being scanned (or the cooldown joke is a lie) then do it. Do the scanning. Do it then publish. Or stop pretending scanning will save you with a lie that is a cooldown.

Feel like debating this? read supplychain.exposed first then we shall debate

[mhoye]

That was nonsense.

[0x73746F66]

That was nonsense.

that was too quick a response, to have done any thinking on the topic, make a real point or stop gas lighting people actually trying to fix the problem - troublemakers are obvious

This whole idea is absurd.

Want a 7 day cooldown on by default while letting malware in the NPM door in the first place?
Tell that to the team that shipped a fix a week late because a cooldown timer you set could not tell a patch from an attack

[michaelaubert]

That was nonsense.

that was too quick a response, to have done any thinking on the topic, make a real point or stop gas lighting people actually trying to fix the problem - troublemakers are obvious

Straw men and whataboutism also are obvious.

On the plus side, you didn't actually say anything about whether the proposed change should be implemented.

[0x73746F66]

let's talk about that strawman then, cooldowns take credit for the real control. The real control is the detection. You must have missed the point so i'll say it again. The cooldown should be before the package is published so the scanning can happen while no one can install yet. Putting a cooldown on a package manager installation HOPING the real controls, the scanning, happens, is a not a control, it is a tax. A tax you pay when you do not install a patch for an exploited vulnerability.

Please stop trying to gaslight the only person in this thread trying to actually protect the industry , Read the content linked and bring a curiosity instead of dogma.

[michaelaubert]

let's talk about that strawman then, cooldowns take credit for the real control. The real control is the detection. You must have missed the point so i'll say it again. The cooldown should be before the package is published so the scanning can happen while no one can install yet. Putting a cooldown on a package manager installation HOPING the real controls, the scanning, happens, is a not a control, it is a tax. A tax you pay when you do not install a patch for an exploited vulnerability.

Please stop trying to gaslight the only person in this thread trying to actually protect the industry , Read the content linked and bring a curiosity instead of dogma.

That contained a much better explanation. Thank you.

Hopefully, you'll open up to the idea of being wrong about, if nothing else, "only person".

[0x73746F66]

Only person who makes you think I hope. no one respects the followiers and yes men.

Here's more to think on.

If a low-profile malicious package is never caught, your seven-day cooldown installs it on day seven, still malicious

The danger is not that the cooldown timer sits there doing nothing. It is that people believe it does something.
That is a placebo.

A team that turned on cooldowns thinks it bought protection. It only rescheduled its installs to land behind someone else's detection. That false confidence displaces the control that works. The worst thing about a placebo is that you stop taking the medicine. Or in the caee of a cooldown, that there was even other medicine you needed to take too becuase this cooldown placebo was never medicine, it takes credit for it when it works and did nothing either way.

Once you attribute the imaginary protection back to detection, only the cost is left.
What cost?
Sysdig’s Zero Day Clock tracks median time-to-exploit falling from 771 days in 2018 to four hours by 2024.
That was 4 hours 2 years ago!
Mandiant’s M-Trends 2026 reports a mean time-to-exploit of roughly negative seven days.
CrowdStrike finds that 42 percent of exploited vulnerabilities are hit before they are public.

Cooldowns stop the patches in the face of that data - like the data is not real.

Want to argue for cooldowns?
You need to argue against those reports and data - I wish you luck good sir (and all the thumbs down followers should get a grip on reality and consider new facts as a curiosity and not a thing to dismiss so easily)

[mhoye]

Whatabouting a modest improvement in ecosystem safety and trying to reframe it as a whole different problem you coincidentally just happen to be selling solutions to don't sound like the ingredients of a good faith exercise, much less a good use of anyone's time.

[mlevison]

A different take and framing. Background: I'm not a full time developer any more, although I was for over 20yrs. All of my apps and code are part time and hobbyist.

In addition, through my professional work as Agile Educator and Coach, I've had to learn about security.

As a part time developer, I don't touch my applications for weeks. I will only become aware of security problems when Gitbot emails me. Even then it might be days before I can do anything. I suggest that there are many people like me.

One of things in the security world has taught me is defence in depth. Setting a default minimum package age is a small mitigation, not sufficient but a start. I'm sure the comments about scanning are on the money but this isn't binary. Why not yes and...?

Default minimum package age helps people like me who will never put enough thought into securely configuring npm. If you know enough to debate on this subject you know enough to change the defaults for your projects.

Let me frame it this way, I have over 20 yrs of experience building applications. 40 yrs in the software industry and until I saw a post on Mastodon I just wasn't aware. Set the defaults for me and not someone who does this day to day.

[0x73746F66]

Whatabouting a modest improvement in ecosystem safety and trying to reframe it as a whole different problem you coincidentally just happen to be selling solutions to don't sound like the ingredients of a good faith exercise, much less a good use of anyone's time.

coincidentally? No, it's entiurely the point, you're right that I solve these problems, I care about the commuity more than the people character sniping. Trying to help means contributing facts and discussing the topic, how about you try that for once?

Actually try looking into me. I am a full time government employee on a government wage. Lifetime OWASP member, and have contributed to Transparency Exchange API, RedHat security, AWS Botocore, etc. the rest of that list of communty and open source speaks for itself.

Point to anywhere or any reference I make here about any other motive?
Try to be curious and consider facts presented, why open a thread of you will just attack anyone trying to present facts and truths to you?

If you want to bring up anything "I create", did you read the link I shared? That stuff is donated.. had you read you would already know. I offer to donate to any registry willing to actually do the protections, instead of offer a placebo that only steals credit from researchers who are doing the scaning packages. Registries offering a cooldown is a registry claiming the cooldown was the safety mechanism when it works. A cooldown does nothing unless someone gets hit and you actually get a report (and take action in time). Where's the proof you will act in time? Where is the actual protections you are offering, All I see is a setting that EXPECTS someone to be harmed and a MANYBE the registry does something afterwards. I see a WISH and a borderline malpractice setting being offered here.

How about you put that scanning, the scanning you may or may not do today (i'll donate mine if you accept), put scanning BEFORE the registry publishes in the first place? Put the cooldown where it belongs, on the registry side, once, instead of pushing the burden down to EVERY team on the planet...

Welcome @mlevison glad to have constructive contributors enter!

I suggest that there are many people like me.

@mlevison would you prefer the registry perform the scan before publishing, or that you and every other person using these has to scan yourself OR hope someone else get's exploited first while you are on a cooldown, all while you risk missing patches. Those patches are statistcally more likely to fix real problem that will be exploited becuase the cooldown stopped the patches, do you feel safer?

defence in depth

The cooldown SUBTRACTS from defence in depth, it takes away patching for a time period. it has ZERO ability to detect malware. There is noone at the registry that see's you and think "Mark just used cooldowns, let me go scn for malware in his packages for him", NO!.. the real defense is elsewhere, not at the registry, not at your cooldown setting and they (the registry) are pretending it is a "you problem" feeding you dogma to feel good abou that bad behaviour, and try to hand you a placebo "cooldown" while they may or may not get a report from researchers, or someone who got popped instead of you. Your cooldown does not trigger any malware scanning for you, you should still scan for malware, and had cooldowns never been invented, you should scan for malware yourself because with or without cooldowns you only hope someone will, and the registry is not at all saying they do that for you, read carefully, the worst part is that the registry chose to make you wait for that protection if you are "smart" and use cooldowns, which means that they want other people to get attacked and report they were attacked so you stay safe.

Default minimum package age helps people like me

That is a dogma that too many people have been brainwashing you with, it is a placebo, you are fed and stop being curious about the real protiections, the real security control. the real failure to your defence in depth that a cooldown burdened you with. Now that you are informed, think about that dogma? Would you trade your defence in depth protections from exploits during hte riskiest period of exploitation every report's stats tell you, for a placebo like cooldown that just hopes someone else gets hit before you so you stay afe?

If you know enough to debate on this subject you know enough to change the defaults for your projects.

Even if you are told a dogma and myth such as cooldowns, that is now knowledge. the person telling you had been told by someone else and liek aparrot just soread the bad adivce that will actually cause you more harm, and the only thing it does for you, is make a setting that REQUIRES someone else is harmed first AND they tell the registry. the truth is, cooldowns do nothing. hey either have mass exploitation first then the registry listens and pulls a package OR the registry is advised by someone like me that there is malware and maybe they listen and do somehting for the people on cooldow, i can't stress enough that you are on cooldown not being patched and risk getting exploited, the data shows that 42% of all known vulnerabilites are exploited 7 days BEFORE publishing, your cooldown of 7 days mens on average that is 14 days you REFUSE a patch that will protect you, while you hope someone else gets you the makware fix - the cooldown did not fix anything for you.

This whole thing is cognitive dissonance for the registry and users who don't fact check the dogma.

Registry people who argue for a cooldown? It is obvious to anyone who takes a moment to ask "why?" a convenience, an easy "make it your problem devs" kind of change. If registry people love cooldowns so much - add a cooldown to your own registry, and prove you love the cooldowns! Use the cooldown once to stop publishing until YOU scan it, instead of uskin millions of users to do that for you or get exploited and tell you (doing your job) keeping everyone else safe