November 26, 2025
Ship late, sleep great?
Show HN: Safe-NPM – only install packages that are +90 days old
New tool says “wait 90 days” before adding code — fans call it smart, critics call it slow
TLDR: Safe‑NPM installs only versions at least 90 days old to avoid sudden malicious updates. Commenters split: some say it duplicates npm/pnpm features and fails to control hidden nested packages, while others argue waiting means missing urgent fixes—making the real battle safety vs speed.
Hacker News just met Safe‑NPM, a button that tells your app to only install code that’s been public for at least 90 days. The pitch: stop surprise hacks from freshly published updates by letting the wider security crowd find the bad stuff first. Sounds safe? The comments erupted. Team Patience cheered the vibe of “older is wiser,” while Team Now shot back with the zinger: “So we’re 90 days late on fixes?” Links flew like popcorn: one crowd asked if this is already covered by npm itself (docs), another pointed to pnpm’s built‑in defenses (pnpm) and basically said, “We’ve had this.” The spiciest take slammed the tool for not locking down those hidden, nested add‑ons your main packages pull in, calling it “vastly less useful” without full control. Others went practical: pin exact versions and block install scripts—translation: lock your stuff and don’t let random code run. Meanwhile, Safe‑NPM’s knobs (like stricter mode and custom wait times) got polite nods, but the vibe was clear: if it can’t wrangle the whole dependency family, people will stick with tools that do. And yes, the jokes landed too—“No‑FOMO NPM,” “Grandma‑approved packages,” and plenty of “ship late, sleep great” memes made the thread feel like a roast with a side of cybersecurity.
Key Points
- •Safe-npm installs only package versions older than a minimum age (default 90 days) to mitigate supply chain attacks.
- •It filters available versions from the npm registry by publish date, then applies semver constraints to choose the newest allowed version.
- •Installation options include npm global install via @dendronhq/safe-npm or building from source and linking the binary.
- •Key options include --min-age-days, --ignore, --strict, --dev/--prod-only, and --strategy (direct or overrides).
- •The overrides strategy, which writes resolved versions to package.json’s overrides field, is currently disabled.