# Compromised npm packages: what happened and how a cooldown period protects youEN
Alessandro Corbelli~7 min
The waves of compromised npm packages - from chalk/debug to the Shai-Hulud worm and the 2026 episodes - and a simple, effective defence: pnpm's minimumReleaseAge, with tested configuration examples.