Uptime Kuma Adds Two-Week Cooldown for npm Packages to Thwart Supply Chain Attacks
The popular open-source monitoring tool Uptime Kuma now implements a 14-day delay for integrating new npm packages, a significant step to mitigate supply chain risks.
Uptime Kuma, a widely-used self-hosted monitoring tool for websites, Docker containers, and more, has introduced a critical security enhancement in its version 2.5.0 release. To combat the growing threat of supply chain attacks, the project now enforces a mandatory 14-day "cooldown" period before it will trust and integrate newly published npm packages. This proactive measure aims to significantly reduce the risk of compromise from malicious code injected into the open-source dependency ecosystem.
The rationale behind this cooldown period is to circumvent the typical attack window for compromised packages. Threat actors often inject malicious code into popular dependencies, and these poisoned releases are frequently discovered and removed within days. Projects that automatically update to the latest versions the moment they are published are thus most vulnerable. By waiting two weeks, Uptime Kuma ensures that most hastily released malicious packages will have been identified and pulled from repositories, thereby protecting its users.
Uptime Kuma's architecture makes it an attractive target for attackers. The monitoring tool operates within internal networks and holds credentials for numerous notification services, including Telegram, Slack, and email. This privileged position means that compromising Uptime Kuma could grant attackers access to sensitive internal systems or credentials. The new cooldown policy directly addresses this risk by adding a crucial layer of defense against dependency confusion and malicious package injection.
Beyond the supply chain security improvements, version 2.5.0 also introduces several new features and enhancements. A new NTP monitor allows users to directly check the health of network time servers, crucial for maintaining synchronized timestamps across distributed systems and ensuring certificate validity. Previously, users could only monitor the server hosting the NTP service, not the service itself. This addition enhances the reliability and accuracy of time-sensitive operations.
Furthermore, Uptime Kuma has lifted the previous ceiling on check intervals, which previously capped out around 24 days. This change benefits users who need to monitor events that occur less frequently, such as certificate expirations or domain renewals, allowing for quarterly checks without the need to artificially shorten intervals. The release also includes a next-rootless Docker tag, catering to users who prefer not to run the monitoring process with root privileges within their containers, further enhancing security and operational flexibility.
The update also addresses several bug fixes. A previously broken badge generator, which produced incorrect URLs due to a doubled slash, has been repaired, ensuring status badges display correctly. The MQTT monitor now supports mqtts:// addresses, enabling secure TLS-encrypted connections without workarounds. Steam game server monitors have been updated to resolve hostnames instead of requiring IP addresses, and the DNS monitor no longer appends the resolver port to service URLs. Discord notifications now correctly render timestamps in the user's local timezone.
Finally, a significant database fix addresses potential data corruption in the stat_daily table. The up and down columns were widened from SMALLINT to an unsigned integer to accommodate higher counts. A SMALLINT can only store values up to 32,767, and monitors checking frequently across many hosts could exceed this limit, leading to gaps or incorrect values in uptime history. This quiet but critical fix ensures the integrity of historical monitoring data for busy environments.