A valid point, but from my view there are two scenarios: 1. You have a known security bug in one of your dependencies that is discovered. If it is a serious b

A valid point, but from my view there are two scenarios: 1. You have a known security bug in one of your dependencies that is discovered. If it is a serious bug you need to check if you are affected and make sure to use the right version and remove the faulty version from your registries. In this case any private npm registry will happily allow you to manually upload the correct version. If your "security" is that you rely on your dependencies to be automatically updated when you happen to rebuild your product then sure this will increase your exposure time. If it is not serious then it does not matter. 2. Somebody has uploaded something malicious (with some very high profile cases of late) Then this might save you. Given that the community finds the malicious code before your delay period runs out.