I'm delighted to discover:
... listing how you can set dependency cooldowns across various package ecosystems.
If you're the sort of person who's less interested in fixing individual problems than in causing entire classes of problem to not exist, a seven-day cooldown default will do that for you.
@rukai The malicious dependency (`proc-macro1`) was published today at 07:11 UTC and the malicious version of `arrayref` depending on it was published at 07:15 UTC. We deleted it at 08:03 UTC.
We'll also investigate the publication times of the other affected crates and add this information to the blog post.
