Why npm's Release Cooldown is Just Security Theater
NPM's release cooldown is security theater
I argue that release cooldowns in npm, pnpm, and yarn are ineffective security theater because they rely on a non-existent community to vet packages. When everyone waits for others to act as canaries, no one does, leaving systems vulnerable. Instead of passive waiting, we must actively scan vendored code with tools like SAST and LLMs before installation to truly secure our supply chains.
Everyone is waiting for everyone else to be the canary, and the canary does not exist.
- paulryanrogers
> If everyone sets a cooldown, there will be no early adopter. Everyone is waiting for everyone else to be the canary, and the canary does not exist.
Except there are researchers chomping at the bit to download every new release of packages in search of vulnerabilities they can exchange for fiat, reputational credit, or both.
- filipn
I don't agree with this take, there are a bunch of security companies that are screening new versions of packages looking for vulnerabilities, so waiting a bit before upgrading to the lastest package is miles better than immediately upgrading.
- kej
A decent amount of recent issues follow the pattern where someone's credentials are compromised, those compromised credentials are used to release a malicious package, and then the original maintainer is the one to notice it but it takes them a little while to get the bad package pulled. A cooldown pretty much completely solves that problem.
Beyond that, a lot of these cooldown criticisms assume everyone will use the same length, which isn't how it has to work. There are people who run Arch because they want the latest version of everything, and there are people who run Debian because they never want a new version to break their system. Some people camp out for the newest iPhone on day 1, and some people wait to see reviews and find out if the antenna is sensitive to how the phone is held. Adjustable cooldowns let everyone choose their own balance between getting the latest features and getting something that is tested.