Give your agent's npm installs a release-age floor, so it never installs what was published this morning

Wed, 21 Oct 2026 16:07:00 +0000

An agent working through a task will run npm install some-package without a second thought, and it will take whatever latest points to at that second. On 21 October that meant vite 8.3.5, which the registry shows was published at 6:38am UTC the same day. Nobody has read that release. No advisory database has had a chance to look at it. The agent doesn’t know or care.

Pnpm on Tokenise

Give your agent's npm installs a release-age floor, so it never installs what was published this morning