One line in .npmrc to shield your project from npm attacks

If you work with WordPress and have a JavaScript build in the mix (Gutenberg, modern themes, plugins with React…), you're using npm. And for months now npm has been the favorite playground for supply chain attacks: someone compromises the account of a popular package maintainer, publishes a version with malicious code, and within hours thousands of projects around the world are infected.

The good news: there's one config line that stops most of these attacks dead.

The magic line

Open (or create) the .npmrc file in the root of your project and add:

min-release-age=7

That's it. That's all.

What it does exactly

With that line, npm ignores any version of any package published less than 7 days ago. In other words: even if popular-package@2.5.7 was released just 3 hours ago, your install won't touch it. It will stay on the latest version that is at least a week old.

Why does this work against attacks? Because when a popular package is compromised, the community spots it very fast (usually within hours) and the malicious version gets pulled. With a 7-day window, you never even get to install it. The attack goes right past your project without touching it.

Requirements

You need npm 11.10.0 or higher. Check your version with:

npm --version

And if you need to, update with:

npm install -g npm@latest

Two things it does NOT fix (important to know)

This isn't a silver bullet. There are two scenarios where min-release-age won't save you:

1. If your package-lock.json is already poisoned, it doesn't matter. The lockfile rules: if it says to install version X, npm installs version X, no matter how old it is. Always review lockfile changes before merging pull requests, especially the automatic ones from Dependabot and the like.

2. npx skips the protection. npx runs packages without going through your install configuration, so the restriction doesn't apply. Be careful with what you run there, especially in CI scripts.

Why should you do it today?

Because the cost is literally writing one line in a file, and the benefit is shielding yourself from 90% of the supply chain attacks happening on npm right now.

If you maintain a WordPress project with a JavaScript build (a custom theme, a plugin with Gutenberg blocks, a headless setup with Next.js on top), this is probably the best cost/benefit security win you can get today in your stack.

Don't leave it for tomorrow. Add it, commit, and move on.