Record · corpus.blog/posts/01a0879f-b696-72cb-be1b-8892517d43ca

Cooldown periods for package updates

mareksuppa.com · published 31 March 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at mareksuppa.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 40
Words captured: 1,284

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://arcticwolf.com/resources/blog/teampcp-supply-chain-attack-campaign-targets-trivy-checkmarx-kics-and-litellm-potential-downstream-impact-to-additional-projects/

arcticwolf.com

Update: Ongoing Investigation and Continued Remediation Read at the source ↗

aquasec.com

https://www.sysdig.com/blog/teampcp-expands-supply-chain-compromise-spreads-from-trivy-to-checkmarx-github-actions

sysdig.com

https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign

wiz.io

https://socket.dev/blog/axios-npm-package-compromised

socket.dev

https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan

stepsecurity.io

https://therecord.media/google-links-axios-supply-chain-attack-north-korea

therecord.media

https://blog.yossarian.net/2026/03/04/cool-down-period-for-packages

blog.yossarian.net

https://x.com/feross

x.com

https://socket.dev/

socket.dev

https://x.com/feross/status/2039778624069603632?ref_src=twsrc%5Etfw

x.com

https://nesbitt.io/2026/03/04/package-managers-need-to-cool-down.html

nesbitt.io

https://docs.astral.sh/uv/reference/settings/

docs.astral.sh

https://pip.pypa.io/en/stable/cli/pip_install/

pip.pypa.io

https://pip.pypa.io/en/stable/topics/configuration/

pip.pypa.io

https://sethmlarson.dev/pip-relative-dependency-cooling-with-crontab

sethmlarson.dev

https://github.com/python-poetry/poetry/issues/10646

github.com

https://github.com/conda/conda/issues/15759

github.com

https://news.ycombinator.com/item?id=47582632

news.ycombinator.com

https://docs.npmjs.com/cli/configuring-npm/npmrc

docs.npmjs.com

https://pnpm.io/settings

pnpm.io

https://bun.sh/docs/install/registries

bun.sh

https://yarnpkg.com/configuration/yarnrc

yarnpkg.com

https://docs.deno.com/runtime/fundamentals/configuration/

docs.deno.com

https://docs.renovatebot.com/key-concepts/minimum-release-age/

docs.renovatebot.com

https://docs.renovatebot.com/configuration-options/

docs.renovatebot.com

https://docs.renovatebot.com/presets-security/

docs.renovatebot.com

https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file

docs.github.com

https://github.blog/changelog/2025-07-01-dependabot-supports-configuration-of-a-minimum-package-age/

github.blog

https://snyk.io/

snyk.io

https://gem.coop/

gem.coop

https://blog.rust-lang.org/2026/01/21/crates-io-development-update/

blog.rust-lang.org

https://crates.io/crates/cargo-cooldown

crates.io

https://github.com/golang/go/issues/76485

github.com

https://github.com/composer/composer/issues/12633

github.com

https://github.com/NuGet/Home/issues/14657

github.com

https://www.crowdstrike.com/en-us/blog/from-scanner-to-stealer-inside-the-trivy-action-supply-chain-compromise/

crowdstrike.com

https://www.stepsecurity.io/

stepsecurity.io

We should all be using dependency cooldowns Read at the source ↗

blog.yossarian.net

https://t.co/xeIoLXxcV0

t.co