Why Cooldown Windows Belong in Every npm Security Strategy | Blog | Endor Labs

What it is

An Endor Labs blog post making the case for "cooldown windows" — delaying adoption of newly-published npm package versions by 24–48 hours — as a defense against short-lived supply-chain malware (Shai-Hulud, chalk/debug, s1ngularity/NX). Beyond the argument, it names concrete tooling for implementing cooldowns and clarifies the pinning-vs-lockfile distinction.

How it works

The thesis rests on a timing asymmetry: malicious npm releases are typically discovered and revoked within 24–48 hours by scanners, researchers, or maintainers. Waiting out that window lets the ecosystem flag a bad release before it enters your build. The post stresses that the projects actually compromised are those without pinned dependencies or lockfiles — they resolve to whatever npm serves at build time.

Pinning ("express": "4.18.2" vs "^4.18.0") locks direct deps but not transitive ones. Lockfiles (package-lock.json, npm-shrinkwrap.json) close that gap by recording the full resolved tree with integrity hashes. Note two edge cases the post flags: package-lock.json is ignored when publishing libraries (so consumers may resolve different versions), and only npm-shrinkwrap.json is publishable to force an exact tree on consumers.

What to do

Actionable options the page names:

• pnpm — "very recently" supports cooldown natively; npm does not offer this easily.
• Private registry — you can build your own cooldown, but it adds infra, auth, caching of public packages, and ongoing maintenance the public registry otherwise handles.
• Endor Labs policies — a new out-of-the-box policy detects recently-released dependencies (direct and transitive), defaulting to a 48-hour window that is configurable to your risk tolerance. Pair it with an action policy to warn developers or block commits introducing deps released in the last 48 hours, scoped to an ecosystem (e.g. npm) and enforcement point (e.g. pull requests). An older out-of-the-box policy flags unpinned direct dependencies. All expressible in Rego, alongside 150+ package health checks.

The specific Rego and OPA policy snippets referenced in the post are shown as images/code blocks on the page and are not reproduced in the fetched text.

Caveats

• This is vendor content; the enforcement tooling described is Endor Labs' product.
• Cooldowns delay all new versions, including legitimate security patches — the post frames the window as configurable but does not address the trade-off of delaying urgent fixes.
• The "discovered within 24–48 hours" claim is asserted, not quantified with data in the text.