alt Hacker NewsGithub owns NPM. Github has unprecedented access to code analysis tools. Github can run static analysis on nearly everything. Introducing a cooldown period seems like the lowest tech solution to a technological problem I have seen in a longwhile.
Replies
Cooldowns have the benefit of being straightforward. It doesn't rely on updating rules, scanning, keeping up with obfuscation techniques, etc. It just stops installs for a period of time after publish.
I think that cooldowns are mostly dumb but they're very cheap to deploy and they do give other approaches (like scanners) more time to adapt/ do their job.
It's certainly the lowest tech piece of their announcements over the last day, as far as I can tell.
https://github.blog/changelog/2026-07-28-npm-publish-time-ma...
That is because Github is not a thing anymore. We are talking about Microsoft.