NPM's Release Cooldown Is Security Theater, Not Real Protection

A blog post on outv.im argues that npm's release cooldown feature — a mandatory delay between package version publications — offers only the illusion of security rather than genuine protection against supply-chain attacks. The author contends the mechanism can be trivially bypassed by malicious actors. The post attracted discussion on Hacker News with 26 points and 22 comments.