verdaccio-age-gate

Verdaccio middleware that blocks npm packages published less than N days ago, reducing supply-chain attack risk.

When a package version is published to npm, it takes time for the community to notice malicious code. This plugin enforces a configurable delay before new package versions are served through your Verdaccio registry.

Installation

npm install verdaccio-age-gate

Configuration

Add to your config.yaml:

middlewares:
  audit:
    enabled: true
  age-gate:
    enabled: true
    min_age_days: 14   # default: 14

How it works

For each package metadata request, the middleware inspects the time field in the npm registry response and removes any version published less than min_age_days days ago. If all versions of a package are too new, the request returns a 404 with a clear error message.

Tarballs (.tgz) are not intercepted — only JSON metadata requests, so the performance overhead is minimal.

Example error

{
  "error": "All versions of some-package are newer than 14 days and blocked by age-gate policy."
}

License

MIT