package-security

name	package-security
description	Age-gated package installation protection. Before installing any package with pip, npm, brew, or cargo, verify it's been public for at least 14 days. Blocks supply-chain attacks on brand-new releases (dependency confusion, account takeover, malware).
version	1.0.0
author	Hermes Agent
license	MIT
platforms	["macos","linux"]
metadata	{"hermes":{"tags":["security","packages","supply-chain","pip","npm","brew","cargo"],"related_skills":["system-watchdog","security-audit-panel","macos-monterey-server-hardening"]}}
scripts	["check-package-age.py","package-install.sh"]

Package Security — 14-Day Age Gate

Overview

Every package install is a trust decision. A brand-new package (or a new version of an existing package) could be:

• Account takeover — attacker publishes malicious version under a compromised maintainer account
• Dependency confusion — attacker publishes a package with the same name as an internal package but on the public registry
• Typosquatting — attacker publishes a similar-sounding name
• Zero-day supply chain — attacker exploits a vulnerability in a package's CI/CD pipeline

This skill enforces a 14-day cooling-off period before any new package or version can be installed. If a legitimate update is needed sooner, you can bypass with BYPASS_AGE_CHECK=1.

How It Works

You (or a script) says: pip install requests==3.0.0
                                │
                                ▼
    check-package-age.py ────── queries registry API (PyPI/npm/crates.io/Homebrew)
                                │
                    ┌───────────┴───────────┐
                    ▼                       ▼
              Age ≥ 14d                Age < 14d
              │                       │
              ▼                       ▼
         INSTALL ✅              BLOCKED 🔴
                                "Wait X.X more days"

Installation

The checker and wrappers are at:

File	Purpose
~/.hermes/scripts/check-package-age.py	Core age checker (PyPI, npm, crates.io, Homebrew)
~/.hermes/scripts/package-install.sh	Shell wrapper (symlinked as pip-safe, npm-safe, etc.)
~/.hermes/scripts/pip-safe	→ symlink to package-install.sh
~/.hermes/scripts/npm-safe	→ symlink to package-install.sh
~/.hermes/scripts/brew-safe	→ symlink to package-install.sh
~/.hermes/scripts/cargo-safe	→ symlink to package-install.sh

Usage

From the Agent (Preferred)

Always use the *-safe wrappers when installing packages:

# Instead of: pip install requests

pip-safe install requests



npm-safe install express



brew-safe install curl