A one-day npm release cooldown would have blocked 70% of 2026's hijacked packages

What the analysis measured

A dev.to analysis of malicious-package advisories from 2026 puts hard numbers on the release-cooldown defence: an installer setting that refuses any package version younger than N days. The author pulled OSV bulk advisory exports for npm and PyPI, kept malware advisories published between 1 January and 24 October 2026, and dropped withdrawn entries. That left 12,820 npm and 1,545 PyPI advisories. For each package, they measured the gap between the first malicious version's publish time and the advisory's publication, then checked whether a 1-, 3-, 7- or 14-day cooldown would have blocked it.

Hijacked packages are flagged within hours

For 1,336 npm packages classified as hijacked — originally legitimate projects with clean releases before the malicious one — the median detection window was 4.9 hours. A one-day cooldown would have blocked 70.4% of them, three days 81.3%, seven days 85.1% and fourteen days 87.4%.

The reason, according to the post, is that worm campaigns and stolen-token attacks hit popular packages that scanners already watch closely. In the ChainDrop campaign of 4 August, which Microsoft described as a self-spreading Mini Shai-Hulud variant that reached more than 400 npm packages across the keyv, flat-cache and cache-manager ecosystems, [email protected] drew an OSV advisory 0.5 hours after publish, [email protected] after 1.0 hours and [email protected] after 1.7 hours. On 8 October the same worm family published [email protected] carrying a credential-stealing preinstall hook; Socket flagged it 11 minutes later, the OSV advisory followed about 1.7 hours after publish, and npm replaced the package with a security placeholder after 3.1 hours.

Typosquats survive the wait

Packages that were malicious from birth — typosquats, dependency-confusion attempts, spam — behaved very differently. Across 10,160 such npm packages the median window was 100.5 hours, and even a 7-day cooldown blocked only 55%, letting 45% through. The post points to October's MALFEX campaign: eight npm packages with 40,767 downloads whose earliest versions dated to July 2024, including one version that stayed live 429 days before its advisory. Cooldowns do nothing for these; the defence has to be name checking, not waiting.

The analysis also disputes a claim in pnpm's documentation that most malicious releases are caught and cleaned up within an hour. Only 13.1% of advised packages received an advisory within an hour of the first malicious version, and even for hijacks the figure was 10.0% within one hour and 59.7% within six. Across all 11,556 npm and PyPI packages with usable timestamps, the median window was 72.4 hours, with the 75th percentile at 28.9 days and the 90th at 103 days.

What waiting costs

The post also priced the trade-off. Over 180 days, 239 of the 400 most-used npm and PyPI packages shipped a new stable release at least once. For those, a 1-day cooldown kept installs off the latest version 3.94% of the time; 3 days cost 9.71%, 7 days 18.53% and 14 days 29.48%. The real cost is security patches: at a 3-day cooldown, 32 of 141 tracked fixes (22.7%) arrived only after their vulnerability was publicly disclosed, rising to 46.1% at 7 days and 61.0% at 14. Moving from 3 to 7 days bought 8.5 percentage points of malware blocking in exchange for 23.4 points of delayed fixes. Short cooldowns stay cheap because disclosure usually lags the fix — by a median 12.8 days on npm and 7.9 days on PyPI.

Two caveats the author flags: the hijacked-versus-fake split is a heuristic, and OSV timestamps are an upper bound on detection — Socket flagged tensorlake 91 minutes before OSV recorded it. Registry takedowns lag too: where npm installed a placeholder it preceded the OSV advisory for 60.6% of packages, yet the median takedown window was still 5.5 days. PyPI deletes projects outright, leaving only 60 usable timestamps and no PyPI-specific conclusions.

Why it matters

Cooldowns are shifting from opt-in to default: npm gained min-release-age in 11.10.0, pip gained --uploaded-prior-to in 26.0, pnpm 11 turns on a one-day cooldown by default, and uv supports exclude-newer with per-package overrides. This analysis supplies the trade-off numbers that policy discussions have lacked. One day is close to free and stops most token-theft and worm attacks; seven days adds modest protection while delaying nearly half of all security fixes; and no cooldown length touches typosquats, which need name verification instead. The remaining lever is exempting security updates from the wait — something Renovate and Dependabot can automate, and which npm, pnpm and uv now support natively.