GitHub and PyPI Introduce Time-Delay Defenses Against Supply Chain Attacks
GitHub and PyPI are rolling out new time-based defenses to combat the rising tide of supply chain attacks targeting software development ecosystems. GitHub's Dependabot now includes a default three-day cooldown period that delays automatically pulling in newly published package updates, giving the community time to identify and flag malicious releases before they spread widely.
Meanwhile, PyPI is tackling a different attack vector by blocking maintainers from uploading new files to package releases older than 14 days. This prevents attackers who compromise publishing credentials from quietly poisoning trusted, older releases. The platform notes that only a tiny percentage of projects legitimately add files to releases after that window.
Both platforms experienced several high-profile supply chain attacks recently, including campaigns like s1ngularity, Shai-Hulud, and GhostAction. GitHub acknowledges the cooldown is not a silver bullet and recommends developers also use lockfiles for dependency pinning, restricted-scope tokens, and disabled installation scripts in CI environments for stronger protection.