Dependency Cooldowns: Make Your Package Manager Wait Before It Trusts New Code

Most npm supply-chain attacks follow the same script. Someone phishes a maintainer or steals a publish token, pushes a poisoned patch release, and then waits for every ^1.2.3 range on the planet to pi