[carlospolop]

Blog URL

https://research.eye.security/cooldown-or-compromise-the-three-day-rule-for-npm-and-pypi

Blog Title

Cooldown or compromise: the three-day rule for npm and PyPI

Blog high summary

Analyzes npm/PyPI supply-chain attacks where a hijacked maintainer publishes a poisoned release and code executes before application logic: npm preinstall/postinstall, Python .pth/__init__.py, and import/build hooks. Transitive dependencies and LLM agents can expose laptops and CI, enabling credential theft, persistence, repository worming, and destructive actions.

Recommends a three-day release-age gate, committed project configuration, reviewed lockfiles, and frozen or immutable CI installs across npm, pnpm, Yarn, Bun, uv, Poetry, and pip. Narrow exceptions may be needed for urgent patches. Cooldowns do not protect locked malware, Git commits, or compromised GitHub Actions and are not scanners.

PR changes

• src/pentesting-ci-cd/github-security/abusing-github-actions/README.md: Clarified the Python wheel import-time execution path beside the existing package-manager startup-hook coverage and noted the wheels-only policy limitation.

Errors

mdbook build unavailable

[carlospolop]

Decision: close

Not merge-ready after the review and repair attempts: candidate_loses_existing_heading_urls

Head: cb14e05cc0c5aed7ace5c2016c8fd5690468c249