Definition
A defensive setting that adds a short waiting period before a newly published open-source software package can be automatically installed — giving security researchers time to catch and flag malicious packages before they spread. AWS recently made this the default behavior for its Amazon Linux systems.
Why it matters
Attackers increasingly race to poison and rapidly distribute malicious packages that target AI coding agents; a simple default delay meaningfully blunts fast-moving supply-chain attacks with little added friction.