In a significant move to bolster their defenses against supply chain attacks, GitHub and Python Package Index (PyPI) have introduced time-based mechanisms to prevent malicious actors from exploiting vulnerabilities in their ecosystems. The changes come after a string of high-profile attacks on development platforms over the past year.
The introduction of a “cooldown” feature by Dependabot, GitHub’s dependency-update service, is designed to delay package updates for 72 hours, thereby reducing the risk of automatically adopting newly published malicious packages. This cooldown period allows developers and maintainers to review and verify the safety of new package versions before they are incorporated into projects. While this may seem like a short window, it can be enough time for attackers to plant malicious code in popular packages.
The three-day delay was chosen as a balance between avoiding risky releases and keeping up with the latest updates. However, users still have the option to configure a shorter or longer delay through Dependabot’s configuration options. GitHub emphasizes that this is not a foolproof solution and recommends using lockfiles for dependency pinning, restricted-scope tokens, and disabling unnecessary installation scripts in Continuous Integration (CI) environments.
PyPI has taken a different approach by blocking maintainers from adding new files to a package release after 14 days have passed since its publication. This measure is aimed at preventing attackers who compromise publishing tokens or workflows from poisoning old, trusted releases. While there have been no confirmed past attacks on PyPI using this technique, the platform is taking proactive steps to block a potential vulnerability.
The introduction of these time-based defenses highlights the ongoing threat posed by supply chain attacks, which can have far-reaching consequences for software development and deployment. By introducing these measures, GitHub and PyPI are acknowledging that even with robust security measures in place, vulnerabilities can still be exploited through clever manipulation of package updates and release processes.
These developments serve as a reminder to developers and maintainers to remain vigilant and proactive in their defense against supply chain attacks. It’s essential to regularly review and update dependencies, use secure authentication mechanisms, and implement rigorous testing procedures to detect potential threats before they cause harm. By taking these steps, developers can reduce the risk of falling victim to these types of attacks and ensure the integrity of their software projects.
Ultimately, the implementation of time-based defenses by GitHub and PyPI marks a significant step towards mitigating supply chain attacks. However, it’s crucial that developers and maintainers continue to be aware of emerging threats and adapt their security practices accordingly.
Source: Bleeping Computer — 2026-07-26