npm supply-chain attacks are becoming more frequent. GitHub and npm are working on ways to harden the ecosystem, but we can at least do the absolute minimum on our side.

Set a minimum release age.

It prevents your package manager from installing versions published within the last few days. That gives the ecosystem time to discover and remove many compromised releases before they reach your machine.

Three days is better than nothing. Seven is safer.

For npm, add this to .npmrc:

min-release-age=3

For Bun, add this to bunfig.toml:

[install]
minimumReleaseAge = 259200 # 3 days in seconds

It won’t stop every supply-chain attack. It will stop you from being among the first people to install one.