Dependency Cooldowns Revisited After LiteLLM Supply Chain Attack

Summary

Simon Willison revisits the concept of dependency cooldowns — the practice of delaying installation of newly updated packages for a set period — following a supply chain attack on LiteLLM, a popular open-source library used to abstract multiple LLM provider APIs. The post links the real-world compromise to the broader argument that package managers should incorporate built-in cooling-off periods before serving freshly published or updated packages to users. The LiteLLM attack is particularly no