Protect yourself from npm dependency attacks

Recent supply chain attacks targeting popular npm packages like Axios, Next.js, and TanStack highlight the inherent security risks of the npm ecosystem. A practical mitigation is setting a minimum release age for packages, so your package manager won't install anything published too recently. PNPM, Yarn, Bun, and npm all support this feature (though with different naming and units). PNPM v11 defaults to a 1-day minimum automatically. Configuration is done via .npmrc, bunfig.toml, yarnrc.yml, or pnpm-workspace.yaml files. Most tools also allow excluding specific trusted packages from the restriction.