[{"data":1,"prerenderedAt":373},["ShallowReactive",2],{"project-46027878":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":41,"post_text":44,"what":45,"said":60,"maker_in_thread":167,"shape":169,"grid":173,"attempts":333,"same_week":334,"maker_shows":40,"maker_hidden":365,"reader_version":366,"card":367},"46027878","Safe-NPM","only install packages that are +90 days old","title","Show HN: Safe-NPM – only install packages that are +90 days old","https:\u002F\u002Fgithub.com\u002Fkevinslin\u002Fsafe-npm","github.com","kevinslin",1763936054,2025,90,64,804,3837,21,"notable","dev_tools","package manager wrapper","cli",[24,25,26,27],"npm supply chain","npm security","dependency cooldown","package age","roasted",-0.533,{"positive":31,"neutral":32,"mixed":33,"critical":34},3,6,0,17,26,{"idea":37,"execution":39},{"positive":31,"critical":38},15,{"positive":33,"critical":40},2,[42,31,43,33,33,42,33,33,33,33,42,42,33,33,42,33,42,31,42,31,42,31,33,42,42,33,42,33,42,33,33,33,33,33,33,33,33,33,31,42],1,5,"This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2025\u002F09\u002F23\u002Fwidespread-supply-chain-compromise-impacting-npm-ecosystem() and the [Chalk\u002Fdebug Compromise](https:\u002F\u002Fwww.wiz.io\u002Fblog\u002Fwidespread-npm-supply-chain-attack-breaking-down-impact-scope-across-debug-chalk). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older).\n\nInstall: npm install -g @dendronhq\u002Fsafe-npm Usage: safe-npm install react@^18 lodash\n\nHow it w",{"problem":46,"audience":52,"pricing":52,"motivation":53,"time_to_build":52,"stack":57,"openness":58,"stage":59,"team_size":58},{"value":47,"source":48,"evidence":49},"Recently published npm packages may be compromised in supply chain attacks.","maker",[50],{"id":51},"post",null,{"value":54,"source":48,"evidence":55},"Protect users from recently compromised npm packages after Shai-Hulud and Chalk\u002Fdebug attacks.",[56],{"id":51},[],"unknown","launched",{"praise":61,"objections":74,"requests":115,"questions":128,"alternatives":143},[62],{"value":63,"source":64,"evidence":65},"Cooldown idea is worthwhile given npm supply chain risk.","commenter",[66,70],{"id":67,"by":68,"text":69},"46067199","mort96","I get that it's a joke, but I feel the need to defend this project anyway. The problem with NPM isn't any one young package. The problem with the NPM is that any time you run…",{"id":71,"by":72,"text":73},"46062625","beepbooptheory","This article was on the front page recently that discusses the idea behind this: https:\u002F\u002Fblog.yossarian.net\u002F2025\u002F11\u002F21\u002FWe-should-all-be-using-dependency-cooldowns Most of the…",[75,86,97,108],{"value":76,"source":64,"evidence":77},"Does not cover transitive dependencies, so it is much less useful.",[78,82],{"id":79,"by":80,"text":81},"46062618","tkzed49","Not controlling transitive deps makes this vastly less useful because direct deps can specify version ranges (e.g. latest minor version). Personally I'd stick with pnpm's feature.",{"id":83,"by":84,"text":85},"46062821","silverwind","Seems like a worse version of `before` because `before` also handles indirect dependencies, whil this module does not seem to.",{"value":87,"source":64,"evidence":88},"Delaying updates means missing security patches released recently.",[89,93],{"id":90,"by":91,"text":92},"46064074","aussieguy1234","This does mean that security patches released yesterday won't get installed. Its the opposite of \"keep your software up to date\"",{"id":94,"by":95,"text":96},"46062551","asdkkthrowaway","Doesn't this just mean you're 90 days late on any patches?",{"value":98,"source":64,"evidence":99},"Age alone does not make a package safe; pinning and audited updates matter more.",[100,104],{"id":101,"by":102,"text":103},"46062939","cheesekunator","Why does elapsed time mean a library is safe? This is so ridiculous. It doesn't protect you against anything. I'm sure there are 1000s of old libraries out there with hidden…",{"id":105,"by":106,"text":107},"46063459","zelphirkalt","This works only if there are some other people, who will use a dependency \"too early\" to fall victim to some exploit and then notice it, within those 90 days. Imagine, if…",{"value":109,"source":64,"evidence":110},"Widespread use could delay detection of malicious packages.",[111],{"id":112,"by":113,"text":114},"46063152","ttoinou","If everybody does that, won't we take 90 days more to detect problems \u002F hacks of npm packages ?",[116,121],{"value":117,"source":64,"evidence":118},"Support transitive dependencies.",[119,120],{"id":83,"by":84,"text":85},{"id":79,"by":80,"text":81},{"value":122,"source":64,"evidence":123},"Install the newest version that fixes known CVEs rather than just the newest aged version.",[124],{"id":125,"by":126,"text":127},"46065370","PunchyHamster","Now with 9000% more zero-days! > Installs the newest \"aged\" version Probably want to install version that has CVE-fixed instead, i.e find the cve for packages and install latest…",[129,136],{"value":130,"source":64,"evidence":131},"How does it differ from npm's built-in --before flag?",[132],{"id":133,"by":134,"text":135},"46062354","pr0xyb0i","How does it differ from: https:\u002F\u002Fdocs.npmjs.com\u002Fcli\u002Fv11\u002Fcommands\u002Fnpm-install#before",{"value":137,"source":64,"evidence":138},"How long are compromised packages live on average before discovery?",[139],{"id":140,"by":141,"text":142},"46063228","codezero","Does anyone have any statistics on how long a compromised package has been in the wild on average?",[144,152,160],{"value":145,"source":64,"evidence":146},"pnpm minimum release age setting",[147,148],{"id":79,"by":80,"text":81},{"id":149,"by":150,"text":151},"46063659","waterTanuki","Just use pnpm. I've never once had compatibility issues with it on linux\u002Fmac\u002Fwindows over the past 6 years.",{"value":153,"source":64,"evidence":154},"npm install --before flag",[155,159],{"id":156,"by":157,"text":158},"46063858","buu700","I recently learned that this is (for all intents and purposes) a feature in npm as well, specifically the `--before` flag to `npm install`:…",{"id":133,"by":134,"text":135},{"value":161,"source":64,"evidence":162},"Yarn npmMinimalAgeGate setting",[163],{"id":164,"by":165,"text":166},"46069698","yokto","Yarn has a configurable npmMinimalAgeGate setting as well since version 4.10: https:\u002F\u002Fyarnpkg.com\u002Fconfiguration\u002Fyarnrc#npmMinimalAgeGate",{"comments":33,"answered":33,"key":168},[],{"commenters":170,"max_depth":32,"maker_replies":33,"first_comment_mins":171,"lifespan_hours":172},42,4257,139,[174,178,182,186,188,192,194,196,199,201,204,206,209,212,214,216,219,220,222,224,226,228,230,233,235,237,240,244,245,246,248,249,252,254,256,258,261,264,266,268,270,272,276,279,282,286,288,291,294,296,298,300,302,304,308,310,313,316,319,321,323,325,328,331],[175,33,42,176,177,33],"46063257","project\u002Fcritical\u002Fidea","sebmellen",[179,33,33,180,181,33],"46064830","other\u002Fneutral\u002Fnone","MuffinFlavored",[183,33,31,184,185,33],"46066705","project\u002Fneutral\u002Fnone","h33t-l4x0r",[67,33,43,187,68,33],"project\u002Fpositive\u002Fidea",[189,33,33,190,191,33],"46068383","commenter\u002Fneutral\u002Fnone","moritzwarhier",[193,33,33,190,68,33],"46068612",[195,33,33,190,191,33],"46068761",[197,33,33,190,198,33],"46073627","chatmasta",[200,42,42,176,191,33],"46062824",[202,42,33,180,203,33],"46063424","2muchcoffeeman",[205,42,33,180,191,33],"46063506",[207,42,33,180,208,33],"46064794","LelouBil",[210,42,33,180,211,33],"46067642","m4rtink",[213,42,33,190,191,33],"46068903",[215,42,33,180,211,33],"46076822",[217,42,33,180,218,33],"46082623","pianopatrick",[156,42,42,176,157,33],[221,42,33,180,191,33],"46084550",[79,40,42,223,80,33],"project\u002Fcritical\u002Fexecution",[225,40,33,180,106,33],"46063482",[227,40,33,190,80,33],"46065953",[229,40,33,190,106,33],"46067629",[231,31,33,180,232,33],"46062569","someothherguyy",[105,234,42,176,106,33],4,[236,234,33,190,208,33],"46064800",[238,43,42,176,239,33],"46062881","mrconter11",[241,43,31,242,243,33],"46063364","project\u002Fneutral\u002Fidea","jagged-chisel",[133,32,31,242,134,33],[83,32,42,176,84,33],[94,247,42,176,95,33],7,[71,247,43,187,72,33],[250,247,42,176,251,33],"46062806","ntonozzi",[253,247,42,176,191,33],"46062860",[164,255,33,180,165,33],8,[112,257,31,242,113,33],9,[259,257,33,190,260,33],"46063183","lelandbatey",[262,257,33,190,263,33],"46065960","mikeweiss",[90,265,42,176,91,33],10,[149,267,42,176,150,33],11,[125,269,42,223,126,33],12,[140,271,33,180,141,33],13,[273,274,31,184,275,33],"46066667",14,"spullara",[277,38,42,176,278,33],"46070946","vrighter",[280,38,33,190,281,33],"46071340","mdx97",[283,284,42,176,285,33],"46062890",16,"robkop",[287,34,33,180,211,33],"46067637",[289,34,33,180,290,33],"46068907","ghtbircshotbe",[292,34,33,180,293,33],"46070571","c-hendricks",[295,34,33,180,290,33],"46072941",[297,34,33,180,293,33],"46073447",[299,34,33,180,290,33],"46073482",[301,34,33,180,211,33],"46076832",[303,34,33,180,293,33],"46089031",[305,306,33,180,307,33],"46063338",18,"arrty88",[309,306,33,180,106,33],"46063491",[311,306,33,180,312,33],"46063692","actionfromafar",[314,306,33,180,315,33],"46065930","catlifeonmars",[317,306,33,190,318,33],"46066523","solumunus",[320,306,33,190,106,33],"46067664",[322,306,33,190,318,33],"46077193",[101,324,42,176,102,33],19,[326,324,43,187,327,33],"46062990","femiagbabiaka",[329,324,31,242,330,33],"46063006","Waterluvian",[332,324,42,176,126,33],"46065377",[],[335,340,345,350,355,360],{"id":336,"name":337,"points":338,"category":339},"46036908","HN Simulator",538,"ai",{"id":341,"name":342,"points":343,"category":344},"46017175","Forty.News",443,"productivity",{"id":346,"name":347,"points":348,"category":349},"46048252","Flowglad",405,"web_saas",{"id":351,"name":352,"points":353,"category":354},"46051449","KiDoom",362,"games",{"id":356,"name":357,"points":358,"category":359},"46037031","exposedbydefault",275,"security_privacy",{"id":361,"name":362,"points":363,"category":364},"46053076","Yandori News Flow",256,"data",false,"v2",{"id":368,"name":5,"line":6,"ai":365,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":369,"top":18,"kw":370,"maker":11,"domain":10,"tier":19,"attempts":33,"strip":371,"url":9,"mix":372,"praise":63,"objection":76,"sub":21},46027878,-0.53,[24,25,26,27],"1350010000110010131313011010100000000031",[31,32,33,34],1794036686252]