GitHub and the Python Package Index (PyPI) have introduced time‑based barriers designed to slow down supply‑chain attackers, BleepingComputer reports. The two changes — a mandatory cool‑down in GitHub’s Dependabot and a hard upload deadline on PyPI — aim to shrink the windows in which malicious packages can be distributed or existing releases can be poisoned.
Dependabot, the automated dependency‑update service built into GitHub, now waits 72 hours after a new package version is published before it opens a pull request. The idea is to avoid adopting freshly uploaded malware during the lag between an initial publication and a subsequent takedown. Recent history shows that malicious npm packages are often spotted and flagged by security tools within minutes, but removal still relies on human action by maintainers or registry operators. That leaves a gap in which unsuspecting developers can pull the bad code into their projects. GitHub’s hope is that three days is long enough for most rogue packages to be reported and taken down, while still being short enough not to frustrate teams that need the latest fixes.
The cooldown is configurable: teams who want a shorter or longer delay can use Dependabot’s `cooldown` option. GitHub also reminded users that the cooldown is only one layer, and recommended complementing it with dependency pinning via lockfiles, tokens that are scoped to the bare minimum, and disabling unnecessary install scripts in CI pipelines.
On the Python side, PyPI has started rejecting new file uploads to any release that is more than 14 days old. The measure prevents a scenario in which an attacker who steals a project’s publishing credentials — for instance, a leaked API token — could add a malicious file to a popular, long‑established release without altering the version number. By blocking additions after two weeks, PyPI closes that vector. The index’s own analysis shows that only a very small fraction of legitimate projects ever upload new files more than 14 days after a release, so the change is expected to create negligible friction for law‑abiding maintainers.
Both steps are preventive. BleepingComputer notes that no publicly known attack on PyPI has actually used the release‑poisoning technique the 14‑day rule is designed to stop; PyPI is simply eliminating the possibility before it is exploited.
The new controls arrive after a string of high‑profile supply‑chain compromises that affected both the npm and PyPI ecosystems, including the ‘chalk’ and ‘debug’ attacks, the “s1ngularity” operation, the Shai‑Hulud campaign, and the GhostAction incident. GitHub also recently rolled out additional npm security enhancements, and both platforms appear to be moving beyond detection‑only approaches toward automated, time‑based defenses. A Picus Security whitepaper cited in the report underscores the urgency: security teams log only 54% of successful attacks and trigger alerts on just 14%, meaning that most threats move through environments undetected. Time‑based barriers like these aim to catch what detection misses.
See an error? Read our corrections policy or email [email protected].
