🧰 npm Package Cooldown Check

The items that name it 5

• jscrambler npm package publishes malicious preinstall binary
  writeup2026-07-12

  Fails PR checks that introduce/update to a recently published npm package version within a configurable cooldown window

• Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised
  writeup2026-07-01

  Blocks PRs that introduce or update to recently published npm package versions during a configurable cooldown window, creating a safety buffer since most malicious packages are identified within hours.

• Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat
  writeup2026-06-18

  Fails a PR automatically if it introduces or updates to a recently published npm package version within a configurable cooldown window

• StepSecurity + Endor Labs: Mini-Shai-Hulud Wave 2
  writeup2026-05-19

  Automatically fails PRs that introduce or update to recently published package versions during a configurable cooldown window.

• Active Supply Chain Attack: Malicious node-ipc Versions Published to npm
  writeup

  Automatically fails PRs that introduce or update to a recently published package version during a configurable cooldown window, providing a safety buffer before malicious packages are confirmed