Prevent installing any NEWLY published package versions to reduce risk of installing malicious code through compromised packages

[gfox1984]

Hey,

I came across this issue on the npm repo, which was about mitigating the risk of adding a compromised dependency to your project by installing the very latest version of a package.

The idea is to introduce some kind of "cool off" period before fetching a new package (eg: one or two weeks), so that the risk of downloading malicious code that is not yet known of yarn audit is reduced.

npm seems to have a "--before" flag that could be used for this purpose. What does yarn have to offer?