Introducing the NPM Package Cooldown Check

The NPM Package Cooldown Check is a new GitHub PR check from StepSecurity designed to automatically block pull requests that introduce newly released npm package versions, with the aim of reducing exposure to potentially compromised dependencies. By default the cooldown window is two days (48 hours) and the check fails the PR if a dependency was published within that period, though the period is configurable to suit an organisation’s risk tolerance.

It runs on each PR and flags the offending package name, the version change, the file containing the change, and when the cooldown will pass, offering developers a short waiting window before adopting fresh releases. The feature forms part of a broader initiative to bake security into the development lifecycle and to catch supply chain threats via GitHub-native checks, alongside other checks for workflow vulnerabilities and script injection.

The article cites real-world examples of compromised updates, such as the NX build system package and similar incidents with es-lint and the is package, to illustrate why a cooldown can provide a protective buffer without blocking urgent fixes. It is currently described as enabling through the StepSecurity platform and can be configured for organisation-wide rollout or specific repositories.