Reported by 1 outlet
GitHub, PyPI Add Time-Based Defenses Against Supply Chain Attacks
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
GitHub, PyPI Add Time-Based Defenses Against Supply Chain Attacks
bleepingcomputer.com · 79d ago · July 27th, 2026
GitHub's Dependabot now applies a default 3-day cooldown before opening update PRs after a new package version is published, reducing the window for automatically adopting recently published malicious packages. Users can configure shorter or longer delays through Dependabot's
cooldownsetting.PyPI now blocks maintainers from adding new files to a package release 14 days after publication, preventing attackers who compromise publishing tokens from poisoning old, trusted releases. While no past PyPI attacks have confirmed use of this specific technique, the measure is preventative.
These changes follow a wave of high-profile supply chain attacks in the npm/PyPI ecosystems over the past year, including the 'chalk' and 'debug' package hijacks, the 's1ngularity' operation, the Shai-Hulud campaign, and GhostAction.
Bottom line: These defenses raise the bar for supply chain attacks but GitHub acknowledges cooldowns have limitations — lockfiles, scoped tokens, and disabling unnecessary CI scripts remain essential layers.