Nothing Installs at Our Company Until It's a Week Old

Bruno J. describes a company-wide proxy, git-pkgs/proxy, that holds new npm and PyPI releases for seven days (pub for three). In twelve days it served 81,710 downloads, hid 6,116 too-new versions and refused 71 downloads where lockfiles pinned fresh releases. His reasoning: five 2026 hijacks, including axios and litellm, were pulled within about five hours. A blogger's count of 1,336 hijacked npm packages suggests a seven-day cooldown would have blocked roughly 85%. Some lockfile formats bypass the gate, and slower-detected compromises still get through.