TL;DR: Dependency cooldowns are a free, easy, and incredibly effective
way to mitigate the large majority of open source supply chain attacks.
More individual projects should apply cooldowns (via tools like Dependabot
and Renovate) to their dependencies, and packaging ecosystems should invest
in first-class support for cooldowns directly in their package managers