GitHub and PyPI have rolled out new time-based safeguards designed to blunt supply-chain attacks that rely on the speed of automated dependency updates and the trust placed in older package releases.
Dependabot, GitHub’s automated dependency-update tool, now applies a default three-day cooldown before surfacing new package versions to maintainers. The tool works by opening pull requests when new package versions are published, but attackers have repeatedly exploited the short gap between a malicious package’s publication and its removal. GitHub noted that in several recent incidents, malicious npm packages were flagged by security tooling within minutes of upload, yet the packages still needed to be pulled by maintainers or registries, leaving a window in which automated tools or developers could pull the compromised code.
GitHub said the 72-hour window was chosen as a middle ground between security and staying current with legitimate updates, and maintainers can adjust the delay to be shorter or longer through Dependabot’s cooldown configuration. The company also stressed that the cooldown does not fully protect against longer-running compromises, and recommended additional hardening steps including dependency pinning via lockfiles, use of restricted-scope tokens, and disabling unnecessary installation scripts in CI pipelines.
PyPI closes release-poisoning window
Separately, PyPI has begun rejecting new file uploads to package releases more than 14 days after their initial publication. The change targets a technique known as release poisoning, in which an attacker who compromises a maintainer’s publishing token or CI workflow could quietly add malicious files to an older, already-trusted release rather than publishing a new suspicious version.
PyPI said its data showed only a very small percentage of projects legitimately upload files to a release more than two weeks after its initial publication, making the 14-day cutoff a low-friction change for most maintainers. The platform acknowledged that no confirmed past attack has used this specific release-poisoning method, but said it was acting preemptively to close off a dangerous avenue before it is exploited.
Response to a wave of incidents
Both measures follow a string of high-profile supply-chain attacks against the npm and PyPI ecosystems over the past year, including the chalk and debug package compromises, the s1ngularity operation, the Shai-Hulud campaign, and the GhostAction attack. GitHub had already announced broader npm security changes last month, and the new Dependabot and PyPI protections extend that hardening effort.
Security teams relying on automated dependency updates should review their Dependabot cooldown settings and confirm CI pipelines enforce lockfile pinning and scoped tokens, since time-delay mechanisms reduce but do not eliminate exposure to compromised packages.