Quarantine

Lazaretto

Lazaretto holds a version until it meets the account's release-age policy. The default is 7 days. Scan verdicts and policy are separate checks: age alone does not make a package installable.

The npm and PyPI registries filter held versions from metadata, so a package manager can select an older eligible version. A direct request for a held artifact is also denied. Existing caches, external registries, direct URLs and lockfile hosts can bypass this path; see blocked installs.