On October 8, someone pushed [email protected] to npm with a credential-stealing worm in its preinstall hook. Socket flagged it 11 minutes later. The OSV advisory landed 1.7 hours after publish, and npm swapped in a security placeholder 3.1 hours after publish. If your installer refused anything younger than one day, you never saw it.

So I took every malicious-package advisory OSV published for npm and PyPI between January 1 and October 24, 2026, and asked one question about each package: would a cooldown of 1, 3 or 7 days have kept it off your machine?

For hijacked releases of real npm packages, a 1-day cooldown blocks 70.4% . For packages that were malicious from day one, a 7-day cooldown still lets 45% through.

TL;DR (for non-technical readers)

A "cooldown" tells your package installer to ignore any release newer than N days. A lot of malware is caught before it gets that old.

When attackers hijack a real, trusted package, the bad version gets flagged fast: median 4.9 hours.…