Why npm's Release Cooldown is Just Security Theater

NPM's release cooldown is security theater

I argue that release cooldowns in npm, pnpm, and yarn are ineffective security theater because they rely on a non-existent community to vet packages. When everyone waits for others to act as canaries, no one does, leaving systems vulnerable. Instead of passive waiting, we must actively scan vendored code with tools like SAST and LLMs before installation to truly secure our supply chains.

"Everyone is waiting for everyone else to be the canary, and the canary does not exist."