Suggested Feature: Cooldown period on new libraries

[matthewdeanmartin]

Most malicious packages are published, are up on pypi for a day or two and then detected and taken down. If people never upgraded until a library had been up for a week or two, enough time for the community to realize there was a problem, then this would affect people upgrading on an unlucky day.

[simion]

That's actually a pretty nice idea, plus it gives the community time to find possible bugs.
I personally never upgrade a package in the first 2 weeks after it's release. Let the community test it, encounter edge cases, then upgrade.

I'll do it, and we should give it a sane default of maybe 7 days.