TLDR Tech / InfoSec
The case for dependency cooldowns in a post-axios world
Recent npm supply chain compromises, including Axios (57M+ weekly downloads, 84,000 dependents), s1ngularity, and both Shai-Hulud waves, have weaponized semantic versioning ranges (^ and ~) into silent attacker delivery channels, with malicious versions propagating worldwide within minutes of publication. Dependency cooldowns enforce a delay before newly released versions become installable, and a 12-hour minimum would have blocked the Axios and s1ngularity attacks entirely since both were detected within 3 to 4 hours, though one week is the recommended window. Defenders should configure min-release-age in npm 11.10.0+, minimumReleaseAge in pnpm, npmMinimalAgeGate in Yarn, or Dependabot cooldown settings (which extend to GitHub Actions and Python), while pairing cooldowns with package scanners like GuardDog and install-time blockers like Supply-Chain Firewall since patient attackers will adapt by delaying payload execution past the window.
Read the full story