This is a submission for the GitHub Finish-Up-A-Thon Challenge
What I Built
Delay Mirror is a supply chain security gateway for package managers (npm, pip, go, brew). It sits between developers and upstream registries, blocking downloads of packages published within the last N days (default: 3).
Most malicious packages are discovered and taken down within hours of publication. A 3-day cooldown is enough for the security community to complete the find→report→remove cycle—without requiring a full audit or package repository.
The project started in April 2026, the week attackers pushed malicious code into @antfu/ni and eslint-plugin-* through a compromised npm token. Hundreds of thousands of downloads before anyone noticed.
