Amazon Linux 2023 adds dependency cooldown for npm and pip

Users can set a minimum release age for npm packages by creating a global configuration file and using the command `npm-24 config set min-release-age 1 --location=global`. This setting ensures that new package versions are not installed until they have been available for at least 24 hours.

For pip packages, a global configuration setting `global.uploaded-prior-to` can be used to implement the cooldown. The command `python3.14 -m pip config set --global global.uploaded-prior-to P1D` sets the cooldown period to one day. Older pip versions will silently ignore this setting.

While the cooldown enhances security, users can override it to install the latest versions of packages, particularly for critical security fixes. This is achieved by using command-line flags such as `--min-release-age=0` for npm and `--uploaded-prior-to='P0D'` for pip when installing specific packages.

The post recommends using audit tools like `npm auditor` and `pip-audit` to identify packages with known security vulnerabilities. These tools can help pinpoint packages that require immediate updates, allowing users to selectively override the cooldown for these specific packages without disabling it entirely.

Newly published npm and pip packages pose the highest supply chain risk within the first 24 hours of their release, as security scanners may not have analyzed them yet. This feature introduces a 'dependency cooldown' that instructs package managers to skip versions published in the last 24 hours, allowing the security community time to detect and remove potentially malicious packages.

This feature is available on Amazon Linux 2023 and requires Node.js 24 with npm 11.10.0+ or Python 3.14 with pip 26.1+. The necessary package versions are included in Amazon Linux 2023 releases starting from 2023.11.20260608. Pip-audit needs to be installed separately using `python3.14 -m pip install pip-audit`.