add dependencies cooldown

config/config.go

@@ -76,6 +76,16 @@ type Config struct {
 	// Sandbox enables sandboxing of package manager processes with controlled filesystem,
 	// network, and process execution access. Provides defense-in-depth against supply chain attacks.
 	Sandbox SandboxConfig `mapstructure:"sandbox"`
+
+	// DependencyCooldown blocks installation of recently-published package versions.
+	DependencyCooldown DependencyCooldownConfig `mapstructure:"dependency_cooldown"`
+}
+
+// DependencyCooldownConfig blocks installation of package versions published within a
+// configurable time window, reducing exposure to supply chain attacks.
+type DependencyCooldownConfig struct {
+	Enabled bool `mapstructure:"enabled"`
+	Days    int  `mapstructure:"days"`
 }
 
 // SandboxConfig configures the sandbox system for isolating package manager processes.
@@ -225,6 +235,10 @@ func DefaultConfig() RuntimeConfig {
 				Enabled:       false,
 				EnforceAlways: false,
 			},
+			DependencyCooldown: DependencyCooldownConfig{
+				Enabled: true,
+				Days:    5,
+			},
 		},
 		DryRun:               false,
 		InsecureInstallation: insecureInstallation,

config/config.template.yml

@@ -137,3 +137,19 @@ sandbox:
     uv:
       enabled: true
       profile: pypi-restrictive
+
+# Dependency cooldown blocks installation of package versions published within a configurable
+# time window. Malicious packages are often caught within the first few days of publication,
+# so enforcing a cooldown period reduces exposure to supply chain attacks.
+#
+# When a package version is published within the cooldown window, PMG will block the
+# installation with a message indicating when the cooldown expires.
+#
+# Applies to all packages universally (new and existing dependencies alike).
+# Currently supported: NPM in proxy mode only.
+dependency_cooldown:
+  # Enable dependency cooldown. Default is true.
+  enabled: true
+
+  # Cooldown period in days. Default is 5.
+  days: 5