Wait a minimum age before adopting a new package

Description

A package (not a version: the package name itself) that first appeared on its registry less than {{ min_package_age_days }} days ago cannot be added as a new dependency without explicit review.

Rationale

Typosquats and fake packages are, by nature, young. A package with no history has no reputation to evaluate. This rule catches what the release-age rule misses: a first release that is malicious from day one and is then left alone.

Impact

Brand-new legitimate packages need a review before use.

Parameters

The value used is your override, else the profile's, else the default. Bounds limit what an override may set.

Audit

1. Check that new dependency review (CB-DEP-VET-001) or an automated rule flags packages younger than {{ min_package_age_days }} days.
2. Review recent additions for packages that were young when added.

Automated: every check must pass. Scanners report each check by its id.

postmortem

first-publish date of every package

command: postmortem harden --json
control: CB-DEP-AGE-002
coverage: online
flags:
- --online

Remediation

1. Add package age to the new dependency criteria and, where possible, to an automated check on manifest changes.

References

• Concise Guide for Evaluating Open Source Software OpenSSF, guide, accessed 2026-10-16
• Secure Supply Chain Consumption Framework (S2C2F) OpenSSF, guide, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEP-AGE-001 Wait a minimum age before installing a new package version
• related CB-DEP-VET-002 Evaluate new dependencies against written criteria

People and lifecycle