Secure your npm and pip package updates in Amazon Linux

This article explains how to secure npm and pip package updates in Amazon Linux by implementing a dependency cooldown that delays installation of newly published packages.

• Supply chain attacks typically detected and removed within hours; 54% of JavaScript apps install dependencies within 24 hours of release
• Set 1-day cooldown for npm using `npm config set min-release-age 1 --location=global`
• Set 1-day cooldown for pip using `python3.14 -m pip config set --global global.uploaded-prior-to P1D`
• Override cooldown for urgent security patches using `--min-release-age=0` for npm or `--uploaded-prior-to="P0D"` for pip
• Use `npm audit` and `pip-audit` to identify packages requiring immediate security updates
• Cooldown doesn't affect lockfile-based installs with pinned versions
• Major tools like pnpm, Renovate, and StepSecurity now include cooldown features by default

A simple one-line configuration provides immediate protection against supply chain attacks while still allowing urgent security patches to be applied when needed.