Nothing Installs at Our Company Until It's a Week Old
Comments on “Nothing Installs at Our Company Until It's a Week Old”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Bruno J. describes a company-wide proxy, git-pkgs/proxy, that holds new npm and PyPI releases for seven days (pub for three). In twelve days it served 81,710 downloads, hid 6,116 too-new versions and refused 71 downloads where lockfiles pinned fresh releases. His reasoning: five 2026 hijacks, including axios and litellm, were pulled within about five hours. A blogger's count of 1,336 hijacked npm packages suggests a seven-day cooldown would have blocked roughly 85%. Some lockfile formats bypass the gate, and slower-detected compromises still get through.
Why it ranked
No. 5 of 43 with a score of 0.70. The panel rated it highest on practical relevance (0.89) and technical depth (0.86), lowest on significance (0.54). The judges disagreed most on overclaim (spread 0.58), so the story is marked contested.
- AI judgeJudge 2claude-haiku-5-5
- Detailed engineering write-up of a supply-chain defense (7-day cooldown proxy) with concrete incident timelines, real metrics, and actionable configs; strong practical value for builders, modest novelty of the core idea.
- AI judgeJudge 3gpt-5.6-luna
- A detailed, measured engineering account of enforcing package-release cooldowns across ecosystems, with implementation specifics, operational data, failure modes, and configuration guidance. It is highly actionable for organizations managing software supply-chain risk.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.70total under rubric v2.3Contestedjudges differ by 0.58 on overclaim
- Significance0.54
- Reader interest0.82
- Audience breadth0.65
- Practical relevance0.89
- Substantiated0.85
- Technical depth0.86
- New information0.82
- Counts against: Promotional0.06
- Counts against: Overclaim0.38
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.54 | 0.45 | 0.62 | 0.54 | 0.17 | +0.24 | +0.129 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.81 | 0.80 | 0.86 | 0.82 | 0.06 | +0.26 | +0.214 |
| Audience breadthHow many people who build technology does it concern? | 0.53 | 0.75 | 0.68 | 0.65 | 0.22 | +0.13 | +0.085 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.95 | 0.85 | 0.88 | 0.89 | 0.10 | +0.22 | +0.197 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.93 | 0.80 | 0.82 | 0.85 | 0.13 | +0.05 | +0.043 |
| Technical depthHow technically substantive is it? | 0.99 | 0.80 | 0.78 | 0.86 | 0.21 | +0.05 | +0.043 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.88 | 0.60 | 0.97 | 0.82 | 0.37 | +0.05 | +0.041 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.04 | 0.10 | 0.04 | 0.06 | 0.06 | −0.19 | −0.011 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.76 | 0.20 | 0.18 | 0.38 | 0.58 , above the contested threshold | −0.11 | −0.042 |
| Sum of contributions | +0.697 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.697 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-02/5/"><img src="https://rubric.hrih.si/badge/2026-11-02/5.svg" alt="Ranked #5 on Rubric, 2 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 5 matches source. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceNumber
Malicious axios 1.14.1, published after an attacker took over a maintainer's npm account, was up for about three hours before being pulled.
The cited source says the same thing.
The article says “an attacker took over a maintainer's npm account and published two releases that pulled in a remote access trojan on install. Up for about three hours”
The source says “The attack chain was effective for roughly 3 hours (00:21 to 03:25 UTC) before npm removed the compromised packages”
Source cited by the article: securitylabs.datadoghq.com/articles/axios-npm-supply-chain-compromise
Matches sourceNumber
npm removed the last of the 84 malicious TanStack versions 4 hours 35 minutes after the first was published.
The cited source says the same thing.
The article says “npm removed the last tarball 4 hours 35 minutes after the first one went out”
The source says “Last package removed by npm | ~4h 35m | ~4h 9m”
Source cited by the article: tanstack.com/blog/npm-supply-chain-compromise-postmortem
Matches sourceNumber
Huntress saw its first axios infection 89 seconds after the malicious version was published.
The cited source says the same thing.
The article says “Huntress saw its first axios infection 89 seconds after publish”
The source says “The first infection on a Huntress-monitored endpoint landed 89 seconds after [email protected] was published”
Source cited by the article: huntress.com/blog/supply-chain-compromise-axios-npm-package
Matches sourceNumber
litellm 1.107.0 on PyPI was up for 1 hour 43 minutes, and its payload in a .pth file ran whenever Python started in that environment.
The cited source says the same thing.
The article says “litellm 1.107.0 on PyPI (21 October): 1 hour 43 minutes. Its payload sat in a .pth file, so it ran whenever Python started in that environment”
The source says “PyPI: litellm==1.107.0: all seven wheels, live from 11:39:51 to 13:23 UTC”
Source cited by the article: docs.litellm.ai/blog/security-incident-oct-21-2026
Matches sourceBenchmark result
A blogger's analysis of 1,336 hijacked npm packages found a seven-day cooldown would have blocked about 85% of them.
The cited source says the same thing.
The article says “one blogger's count of 1,336 hijacked npm packages, using OSV advisory dates and his own definition of "hijacked", found that a seven-day cooldown would have blocked about 85% of them”
The source says “Hijacked npm packages | 1,336 | 4.9 h | 70.4% | 81.3% | 85.1% | 87.4%”
Source cited by the article: kielltampubolon.id/writing/a-1-day-cooldown-would-have-blocked-70-of-2026s-hijacked-npm-releases
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 3 pts, not on front page
Recorded for context only, checked 2 Nov 2026, 05:46 UTC. It played no part in the ranking.