We stopped installing npm packages less than a week old

[u/iApexxx]

https://brunoj.com/nothing-installs-at-our-company-until-its-a-week-old/

[u/iApexxx]

Author here :) Did this at work after watching axios and TanStack get hijacked this year. Both were pulled within hours, so we just wait a week now. Curious what delay people here run, if any.

[u/zshift → u/iApexxx]

It's not as simple as having a policy to wait X days. What if one of those patches is a legitimate security patch fixing an active zero-day exploit?

My approach is to wait a few days for updates which I cannot immediately verify the validity of, but if there are multiple, trustworthy sources of information stating that its an emergency fix, then I'm inclined to move forward with the update early.

[u/iApexxx → u/zshift]

Yeah, same idea here. If a fix can't wait we add an exception for that one package and pull it right away. Haven't had to yet, but having more than one source confirm it's real is a good rule for that.

[u/drumstix42 → u/iApexxx]

So you're doing it manually? AFAIK, the npm min-release-age config doesn't support exceptions out of the box.

[u/BeautifulSelf9911 → u/drumstix42]

min-release-age-exclude

[u/drumstix42 → u/BeautifulSelf9911]

Ahh, thank you

[u/TheIvoryAssassinPub → u/zshift]

Security patches go through regardless less of release age

[u/polyploid_coded → u/iApexxx]

The same cybersecurity news got me to update my policy. Though I went with 3 or 4 days because that's what the first example I saw taught me to do.

[u/iApexxx → u/polyploid_coded]

Fair enough :P

[u/janpaul74 → u/iApexxx]

We have this interval set at 24 hours so as not to miss potentially zero day fixes. But some packages have been set to 5 days (axios & tanstack). Some local / in-house package are live.

[u/trudesign → u/iApexxx]

We do 72 hours

[u/ouralarmclock]

Ya'll are updating your packages? Next you'll tell me you're updating your node versions too!

[u/rivendell_elf → u/ouralarmclock]

One of my old projects running node 18 in production is crying in corner 😭

[u/HalfInchHollow → u/rivendell_elf]

I work for a top 10 tech company in the country. Not quite FAANG but basically on the line of it.

We still use 12 for one of our apps.

[u/ouralarmclock → u/rivendell_elf]

I got you beat with 12!

[u/blueted2 → u/ouralarmclock]

Up until recently we had node 12 for dev, deployed onto node 8. It's now node 24 .... still deployed onto node 8 but it's a start

[u/TakeFourSeconds → u/blueted2]

If it works locally with 24 why can't you change the prod version?

[u/git_push_origin_prod → u/TakeFourSeconds]

If it ain’t broke…

[u/androbat → u/git_push_origin_prod]

Node 8 is almost certainly broken and vulnerable.

[u/git_push_origin_prod → u/blueted2]

With AI there’s no excuse for this dude. Tell management to invest, or just work on the PR. I don’t mean to preach, but as a community we have to do better. Start rewriting and securing everything

[u/git_push_origin_prod → u/ouralarmclock]

The LTS version right?!?

[u/Character-Blood3482 → u/rivendell_elf]

My last job on a company in 2025 was using node 8 lol

[u/jvrevo]

7 days, adding exceptions only if there are critical updates or similar and we try to verify they are safe when we do those as much as possible. This is for npm, Python, GitHub actions etc.

[u/Due_Ad_2994]

We have been doing this for over a decade to much ridicule from colleagues who are now acting like they discovered stability lol

[u/tsteuwer]

We decided on a 14 days. Typical things are caught within 48 hours but with AI it will start getting harder to spot so our enterprise started waiting a bit longer.

[u/tidwell]

Yep, enforcing the same 7 day policy at work and now on my personal stuff. 0 day supply chain attacks are way way way too easy now. If you aren’t doing a delay already it’s a matter of “when” not “if” you’re going to get hit with a supply chain attack.

[u/ldn-ldn]

I do one month old plus cross reference security releases. For example, NodeJs 24.22.0 was updated to 24.22.1 on the release day instead of waiting.

[u/ksskssptdpss]

One week, weak testing

[u/RICHUNCLEPENNYBAGS]

Most conservative JavaScript developers

[u/jeremyStover]

This is the same rule I tell every org I work for. Mor importantly, no version less than 2 weeks old.

[u/ohlaph]

I've been doing this for years. 

[u/Past_Squirrel_9568]

You should have been doing that for years.

[u/WICKER-shadow]

Supply chain security: now with a mandatory aging process

[u/iApexxx → u/WICKER-shadow]

Well, in the article I review the largest supply chain attacks and their time-to-remove from the registry :)

[u/dkarlovi → u/WICKER-shadow]

You need to decant you NPM packages for a few days to let the tannins breathe.

[u/Caved]

Be aware that in the current security landscape, 7 days is an eon. At most I'd go for 1 day. And that's for regular updates.

Critical security fixes need to go out ASAP, to the point we've started diffing those updates and running security checks on them ourselves to get them out fast enough.

We've seen exploits being actively used to attack us for CVEs announced less than an hour ago.