In response to the LiteLLM supply chain attack, Simon highlights Andrew Nesbitt's overview of "dependency cooldown" mechanisms that delay installing new packages for a few days to catch malicious updates. Major package managers have rapidly adopted this security feature: pnpm, Yarn, Bun, Deno, uv, pip, and npm all added cooldown capabilities between September 2025 and February 2026. This represents a significant industry-wide response to supply chain security threats, with most tools now supporting relative time delays and trusted package exemptions.

Sources: HuggingFace Papers API, GitHub Trending, simonwillison.net