PACKAGE MANAGERS NEED TO COOL DOWN

Summary from the TLDR newsletter

Giving new package versions about a week on a registry before installing them can block most supply chain attacks, as it gives the community and security vendors time to flag problems.