Heuristics for recently created packages and freshly published versions.
Very new packages and versions are not automatically malicious, but recent publication is a useful supply-chain risk signal. The default policy only warns: packages created in the last 7 days and versions published in the last 3 days are flagged when registry metadata includes timestamps.
Summary
Types
@type warning() :: %{ type: :new_package | :new_version, age_days: non_neg_integer(), threshold_days: non_neg_integer() }