NPM's release cooldown criticized as mere security theater

NPM has introduced a release cooldown for package publishing. The cooldown is intended to improve security for the ecosystem. The author of a recent blog post argues the measure is superficial. They describe it as "security theater" rather than effective protection. The critique suggests the cooldown may not address core threats. The post raises questions about the real impact on developers. It calls for more substantive security measures beyond timing controls. Observers are encouraged to evaluate the policy's practical benefits.