MINIMUM RELEASE AGE IS AN UNDERRATED SUPPLY CHAIN DEFENSE

Summary from the TLDR Dev newsletter

Most npm supply chain attacks are smash-and-grabs where malicious versions live for hours before being yanked. Setting “minimumReleaseAge = 7 days” in your package manager, a one-line config change, would have blocked 11 of 21 major incidents from the past 8 years.