Two major open-source platforms have rolled out new policies designed to significantly boost supply chain security by limiting the spread of malicious code. GitHub and the Python Package Index (PyPI) are taking steps to prevent poisoned package versions from rapidly spreading through their ecosystems, thereby minimizing the risk of cyberattacks.
GitHub’s introduction of a “Dependabot cooldown” aims to give maintainers, security researchers, and automated scanners time to identify and remove malicious code before it is incorporated into user pull requests. This three-day waiting period applies only to non-security version bumps and can be modified through configuration options in the dependabot.yml file. According to GitHub, this balance between security and efficiency pushes past the window where most attacks occur while not unnecessarily holding dependencies back.
PyPI has taken a different approach by blocking the upload of new files to releases older than 14 days. This policy is designed to prevent attackers from poisoning long-stable releases, which are often considered safe but can still be vulnerable if their publishing tokens or workflows are compromised. Although this practice has not been abused yet, PyPI emphasizes that there’s no technical reason why attackers wouldn’t attempt it.
The change will primarily affect a small fraction of projects that still publish new files to older releases. Testing has shown that only about 0.4% of the top 15,000 packages have published incompatible wheels more than two weeks after they became available. PyPI believes this policy not only protects users but also simplifies cleanup work in case an attack occurs by making it easier to distinguish between compromised and non-compromised releases.
These new policies demonstrate a growing understanding of supply chain attacks and the importance of proactive measures in preventing them. By slowing down the propagation of potentially malicious code, GitHub and PyPI are reducing the risk of widespread damage from these types of cyberattacks.
For users of these platforms, it’s essential to be aware of these changes and how they impact their projects. Maintainers should also familiarize themselves with configuration options for Dependabot cooldowns to ensure they’re not inadvertently compromising their dependencies.
Source: SecurityWeek — 2026-07-27