You can now use the upstream publish date in Enterprise Policy Manager (EPM) for npm packages. This enables you to define policies that automatically quarantine new packages for a specific time period (e.g., two weeks) after release.

Why this matters

Implementing policies that delay package use is an effective safeguard to protect against zero-day attacks. Enforcing a time lag before consuming a new package or package version gives the community time to find and flag any problems and for intelligence feeds to get updated.

A policy that quarantined npm packages published in the past two weeks would have protected organizations during the September 8, 2025 npm attack which compromised widely used packages like chalk and debug. Within two hours, the community had flagged the problem, but automated CI/CD pipelines had already downloaded the latest versions, the ones containing the malicious code.

Comprehensive defense

When used alongside an EPM policy in Cloudsmith to block or quarantine all known malicious packages, you’ll have protection against zero-day attacks and known malicious packages, ensuring these packages never make it into your software supply chain. For more security rules, check out our Rego recipes.

Publish date policy example

The following Rego code defines a policy that matches and quarantines npm packages whose upstream publish date is within the last 14 days.

package cloudsmith

default match := false

# A package is matched if its upstream publish date is within the past N days.
within_past_days := 14
supported_formats := {"npm"}

match if count(reason) != 0

reason contains msg if {
    pkg := input.v0.package
    within_past_days_date := time.add_date(time.now_ns(), 0, 0, 0 - within_past_days)
    publish_date := time.parse_rfc3339_ns(pkg.upstream_metadata.published_at)

    # Match if the publish date comes after the date of the set number of days ago.
    publish_date >= within_past_days_date
    pkg.format in supported_formats

    msg := sprintf("Package upstream publish date is %v (falls within the past %v days)", [pkg.upstream_metadata.published_at, within_past_days])
}

Upstream publish date is available for npm packages, with additional formats coming soon. Learn more in the Enterprise Policy Manager docs, and contact us to request early access.