Last week, the continuous integration pipeline I set up failed because a package that I had locked three weeks ago was no longer resolving in the same manner on my local machine. The solution? Just wait for 72 hours. Because that seems to be the approach to security these days. 🙄
The new gospel of waiting
Security teams think they have found the answer to supply-chain attacks: Time. Here's a simple suggestion: don't install a package as soon as it's released. Wait 72 hours so that someone else can discover the poison. The entire ecosystem quickly adopted it. In July 2026, GitHub implemented a default 72-hour cooldown for non-security Dependabot updates. Both pnpm and Yarn implemented minimum package age restrictions in September 2025. npm v11.10.0 added min-release-age in February 2026. Additionally, PyPI also took measures to protect against future typosquatting attacks. They decided to block the upload of new files to any release that was older than 14 days. Everything seems reasonable. It seems like adults are finally starting to consider the risk in the supply chain.
The math doesn't math
The unspoken truth is that... Most of the malware you are trying to avoid is eliminated even before your cooldown begins. Consider the major attacks in 2025/2026: Axios, s1ngularity, Shai-Hulud. All malicious packages were found and removed within a median of 14 hours. This window of 72 hours is sheltering you from a danger that would have perished already, by the 15th hour. You are essentially paying three days of opportunity cost to be protected from a fire that your sprinklers have already extinguished.
Attackers read the docs too
Delays do not merely inconvenience your opponents; they actually instruct them. Kennedy Toomey, an Application Security Researcher at Datadog, said it plainly in an April 16, 2026 report:
"Dependency cooldowns are not completely effective. If everyone starts using cooldowns, intelligent attackers can just wait with executing the malware and survive the cooldown. Code that doesn't execute on install takes longer to discover."
Read that twice. The countermeasure teaches attackers to just... wait longer. If you implemented a 72-hour gate, the adversary set a 96-hour fuse. Incumbent malware has now been engineered to hibernate throughout your entire safeguard timeframe and activate after you've patched. At the same time, the number of new open-source malware packages continues to increase. In fact, Sonatype discovered 394,877 new open-source malware packages in Q4 2025, which is 476% more than the previous three quarters combined. Taking a three-day break can't combat such a workload. It just gives you the illusion of being occupied.
What the cooldown actually costs
Allow me to share what's really happening, as I have firsthand experience. Our team is small. If we lose an hour to "why won't this install", that's an hour not spent on our product. And then, the codebase becomes inflexible. You end up pinning everything so hard, postponing any updates, and six months down the line you end up with a fossil dependency graph that nobody is willing to deal with. That's the deal. We lose a lot of speed. The consultancy Evil Martians summed up the feeling in their analysis from July 28, 2026. They urged not to "introduce tools just because it's safer," since this "makes processes slower and often gives a false sense of security without real risk reduction."
What I remember most is the expression "False sense of security". Because when a team feels safe they stop being vigilant and that's worse than speeding up and staying paranoid.
So what do you actually do
I'm not suggesting that you blindly install everything in the middle of the night. 🔒
What I mean is that we should select tools that detect harmful activities, and not tools that simply postpone an attack based on a pre-set time. Runtime scanning and behavioral analysis beat arbitrary time gates. Fast detection and revocation is where the 14-hour median comes from, so lean into that ecosystem. Pin for reproducibility, not for superstition, and keep a real update cadence. A cooldown could be used as one small indicator among a bunch of real defenses. As the headline policy, it's theater with good production values. The hackers have already changed their approach. The real question is, will your security staff? Or will you continue to pay them three days of agony to watch a magic act?
