GitHub and PyPI add time-based supply-chain defenses

Dependabot now waits three days before proposing dependency updates, while PyPI blocks new files added to releases older than 14 days. GitHub and the Python Package Index introduced the time-based defenses to reduce the impact of supply-chain attacks.

The changes follow multiple high-profile attacks across the two development ecosystems over the past year, including the chalk and debug attacks, the s1ngularity operation, the Shai-Hulud campaign, and the GhostAction supply-chain attack.

GitHub adds a three-day Dependabot cooldown

Dependabot reads package-version data and opens pull requests when it finds updates. Under the new default setting, it delays that process for 72 hours, reducing the chance that projects automatically adopt a newly published malicious package.

Security tools have detected malicious npm packages within minutes of publication in recent incidents. Detection alone does not eliminate the threat: maintainers and vendors must still remove the packages, leaving a window in which developers may download and incorporate the malicious code.

Recommended reading

Claude Cowork reportedly escaped its Mac sandbox

GitHub said three days balances release safety with access to current upgrades. Users can configure a shorter or longer delay through Dependabot’s cooldown option.

GitHub also cautioned that the setting cannot prevent longer-term compromises. It recommends using:

• Lockfiles to pin dependencies
• Restricted-scope tokens
• Disabled, unnecessary installation scripts in CI

PyPI blocks late changes to published releases

PyPI now prevents maintainers from adding files to a package release more than 14 days after publication. The rule is designed to stop attackers who compromise publishing tokens or workflows from poisoning older, trusted releases.

PyPI said only a very small percentage of projects legitimately upload files more than two weeks after release. The platform has not confirmed any known past PyPI attack using this release-poisoning technique, but it is applying the cutoff preventatively.

×