chalk and debug shipped malware for a few hours. Waiting 7 days would have skipped it.

In September 2025, a maintainer of several very popular npm packages, including chalk and debug, had their account phished. New versions were published with code that tried to steal cryptocurrency from browsers. The community spotted it quickly, and the bad versions were removed within hours.

The teams that got hit were the ones whose installs ran in those hours. Teams that waited even a couple of days never saw the bad versions at all.

Most bad releases have a short life

Not every bad release is an attack. Most are ordinary mistakes: a broken build published by accident, a regression the tests missed, a missing file. The pattern is the same:

day 0   release published
day 1   issues opened, maybe a security report
day 2   version deprecated or unpublished, fix released

So a simple rule removes most of the risk: don't install a release until it's a few days old. Seven days is a common choice.

Setting it up

Renovate has it built in:

{
  "minimumReleaseAge": "7 days"
}

Dependabot has a cooldown option in dependabot.yml for the same idea:

updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    cooldown:
      default-days: 7

Lockfiles do the rest: with npm ci and a committed package-lock.json, nothing new is installed until a pull request changes the lockfile.

The exception: security fixes

A release that patches a known vulnerability is a different trade-off: the risk is in not installing it. Keep a separate, faster path for security updates, and review them like any other change.

What we do

Versyka's weekly upgrades collect minor and patch updates that are at least 7 days old and open them as one tested pull request, while security fixes take their own path. More in the docs.

Does your dependency bot install releases the day they come out?