Comment by boredhedgehog

> Why cooldowns? Most npm (or pypi) compromises were taken down within hours,

But won't more people on cooldown mean less likelihood to catch the bug, thus extending the need for cooldowns?