Protect Dependency Installs from Supply-Chain Attacks with a Release-Age Buffer

Note#204

notes
Published

2026-04-01

After the litellm incident on PyPI, and then axios on npm, I came across this trick on Twitter: configure your package manager to reject dependency releases that are too new.

uv

# ~/.config/uv/uv.toml
exclude-newer = "7 days"

npm

# ~/.npmrc
min-release-age=7 # days
ignore-scripts=true

bun

# ~/.bunfig.toml
[install]
minimumReleaseAge = 604800 # seconds

References