[normie3000]

> If everyone sets a cooldown, there will be no early adopter.

This ignores all the security companies & researchers screening packages.

[chmod775]

Also ignores the common vector of the maintainer getting compromised and their credentials immediately being used to push malware.

Most maintainer are going to notice that themselves.

[pixl97]

Exactly, and the vast majority of the attack success is in a very short period of time.

It will make credential attacks much harder to pull off successfully and the returns from using them will drop pretty dramatically.

[saghm]

Isn't this what alpha/beta/RC releases are for, ensuring that there are no issues before a general release? I just don't get ecosystem has decided to use client-side configurations for this rather than just marking the releases in the ways that already exist.

[pixl97]

When the attacker gets your npm/gh credentials they just publish a new 'full' release making your idea worthless.

[normie3000]

If it helps, think of cooldown periods as a way to do staged rollouts.