Safe-NPM
Dev tools
package manager wrapper
SHOW HN2025
How HN took it
3 positive, 6 neutral or asking, 0 mixed, 17 critical, out of 26 comments about the project. Thread score -0.53.
Idea: 3 for, 15 againstExecution: 0 for, 2 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Cooldown idea is worthwhile given npm supply chain risk.
From 2 comments
I get that it's a joke, but I feel the need to defend this project anyway. The problem with NPM isn't any one young package. The problem with the NPM is that any time you run…
mort96 on HNThis article was on the front page recently that discusses the idea behind this: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns Most of the…
beepbooptheory on HN
Objections
Does not cover transitive dependencies, so it is much less useful.
From 2 comments
Not controlling transitive deps makes this vastly less useful because direct deps can specify version ranges (e.g. latest minor version). Personally I'd stick with pnpm's feature.
tkzed49 on HNSeems like a worse version of `before` because `before` also handles indirect dependencies, whil this module does not seem to.
silverwind on HN
Delaying updates means missing security patches released recently.
From 2 comments
This does mean that security patches released yesterday won't get installed. Its the opposite of "keep your software up to date"
aussieguy1234 on HNDoesn't this just mean you're 90 days late on any patches?
asdkkthrowaway on HN
Age alone does not make a package safe; pinning and audited updates matter more.
From 2 comments
Why does elapsed time mean a library is safe? This is so ridiculous. It doesn't protect you against anything. I'm sure there are 1000s of old libraries out there with hidden…
cheesekunator on HNThis works only if there are some other people, who will use a dependency "too early" to fall victim to some exploit and then notice it, within those 90 days. Imagine, if…
zelphirkalt on HN
Widespread use could delay detection of malicious packages.
From 1 comment
If everybody does that, won't we take 90 days more to detect problems / hacks of npm packages ?
ttoinou on HN
Requests
Support transitive dependencies.
From 2 comments
Seems like a worse version of `before` because `before` also handles indirect dependencies, whil this module does not seem to.
silverwind on HNNot controlling transitive deps makes this vastly less useful because direct deps can specify version ranges (e.g. latest minor version). Personally I'd stick with pnpm's feature.
tkzed49 on HN
Install the newest version that fixes known CVEs rather than just the newest aged version.
From 1 comment
Now with 9000% more zero-days! > Installs the newest "aged" version Probably want to install version that has CVE-fixed instead, i.e find the cve for packages and install latest…
PunchyHamster on HN
Questions
How does it differ from npm's built-in --before flag?
From 1 comment
How does it differ from: https://docs.npmjs.com/cli/v11/commands/npm-install#before
pr0xyb0i on HN
How long are compromised packages live on average before discovery?
From 1 comment
Does anyone have any statistics on how long a compromised package has been in the wild on average?
codezero on HN
Alternatives named
pnpm minimum release age setting
From 2 comments
Not controlling transitive deps makes this vastly less useful because direct deps can specify version ranges (e.g. latest minor version). Personally I'd stick with pnpm's feature.
tkzed49 on HNJust use pnpm. I've never once had compatibility issues with it on linux/mac/windows over the past 6 years.
waterTanuki on HN
npm install --before flag
From 2 comments
I recently learned that this is (for all intents and purposes) a feature in npm as well, specifically the `--before` flag to `npm install`:…
buu700 on HNHow does it differ from: https://docs.npmjs.com/cli/v11/commands/npm-install#before
pr0xyb0i on HN
Yarn npmMinimalAgeGate setting
From 1 comment
Yarn has a configurable npmMinimalAgeGate setting as well since version 4.10: https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate
yokto on HN