Software projects often depend on packages maintained by other developers. A compromised maintainer account can therefore affect far more than a single project. If an attacker uses that account to distribute a malicious update, organisations may be affected even when they take good care of their own application security.
On 25 June, npm announced an additional safeguard for accounts responsible for widely used packages. Certain sensitive changes, such as changing an email address or using a two-factor authentication recovery code, trigger a 72-hour period during which publishing and other sensitive actions are paused. Packages remain available to download and install during that period.
The delay can give a maintainer time to notice suspicious changes and respond. For development teams, it is also a useful prompt to examine their own dependencies. Who maintains the packages supporting the service? What permissions do accounts with publishing access hold? And what happens if one of those accounts is unexpectedly blocked?
Our practical recommendation is to make dependencies and publishing permissions visible within the maintenance process. Combine updates with checks for unexpected changes and keep a tested recovery path available. A temporary publishing pause does not replace these measures, but it demonstrates why deliberately introducing a delay can sometimes improve security.