If you install a package that has been part of a supply chain attack, you definitely have a problem. If you have a dependency with a vulnerability, you might ha

If you install a package that has been part of a supply chain attack, you definitely have a problem. If you have a dependency with a vulnerability, you might have a problem, and any really bad one you are likely to find out about anyway. You can also subscribe to notifications for CVEs as well. Obviously, you would ideally be reviewing every update to every dependency manually, and reviewing them for security problems as well, but in the absence of the resources to do that, the risk balance for cooldowns makes a decent amount of sense (especially since the number of high-profile everyone-patch-now vulnerabilities in the npm ecosystem is now a fair bit smaller than the number of supply chain attacks).