48-hour minimum release age across npm, pnpm and bun
Refuse to install any software package published less than two days ago, to dodge poisoned releases.
how it works
npm min-release-age=2 (days, ~/.npmrc), pnpm minimum-release-age=2880 (minutes, separate rc to avoid npm warnings), bun minimumReleaseAge=172800 (seconds, bunfig) — three keys, three units, three files.
Technique: A pattern or hard-won lesson, written down so it isn't learned twice.
The code for this one lives in a private repo. This page explains the idea so you can build your own.