docs: add --min-release-age as supply chain mitigation#73
Conversation
Add dependency cooldown (--min-release-age, npm v11.10.0+) to the supply chain attack mitigations in the security best practices guide. Recommend a 1-day cooldown as the minimum effective value. Every major npm supply chain incident in 2025-2026 had an exposure window well under 24 hours, making even a 1-day delay sufficient: - Nx/s1ngularity (Aug 2025): ~4-5h window https://nx.dev/blog/s1ngularity-postmortem - Shai-Hulud (Sep 2025): hours before detection https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack - axios (Mar 2026): ~2-3h window, 100M weekly downloads https://workos.com/blog/axios-npm-supply-chain-attack - TanStack (May 2026): ~30 min window, 42 packages https://tanstack.com/blog/npm-supply-chain-compromise-postmortem Other projects also propose cooldown as a mitigation: pnpm 11 ships with minimumReleaseAge enabled by default (1 day): https://pnpm.io/blog/releases/11.0 StepSecurity Secure Registry offers a configurable cooldown and confirmed their customers were unaffected during the May 2026 @AntV compromise: https://www.stepsecurity.io/blog/introducing-secure-registry-install-time-defense-for-the-npm-supply-chain Signed-off-by: Norbert Manthey <nmanthey@amazon.de>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
PR SummaryLow Risk Overview Adds a new reference link target for Reviewed by Cursor Bugbot for commit 94ca847. Bugbot is set up for automated code reviews on this repo. Configure here. |
👋 Codeowner Review RequestThe following codeowners have been identified for the changed files: Team reviewers: @nodejs/security-wg Please review the changes when you have a chance. Thank you! 🙏 |
1 participant
Add dependency cooldown (--min-release-age, npm v11.10.0+) to the supply chain attack mitigations in the security best practices guide. Recommend a 1-day cooldown as the minimum effective value.
Every major npm supply chain incident in 2025-2026 had an exposure window well under 24 hours, making even a 1-day delay sufficient:
Other projects also propose cooldown as a mitigation:
pnpm 11 ships with minimumReleaseAge enabled by default (1 day): https://pnpm.io/blog/releases/11.0
StepSecurity Secure Registry offers a configurable cooldown and confirmed their customers were unaffected during the May 2026 @AntV compromise:
https://www.stepsecurity.io/blog/introducing-secure-registry-install-time-defense-for-the-npm-supply-chain