GitHub and PyPI Add Waiting Periods to Slow Down Supply-Chain Attacks

Key points

• GitHub's Dependabot, the tool that automatically updates software libraries, now waits 72 hours before pulling in a newly published version.
• PyPI, the main storage site for Python software packages, will refuse new file uploads to any release older than 14 days.
• Both changes are direct responses to a run of supply-chain attacks, including the Shai-Hulud and GhostAction campaigns.
• Malicious packages are often spotted within minutes, but that window before removal is enough to poison downstream projects.
• Developers can shorten or lengthen the Dependabot delay through its cooldown setting.

Two of the biggest homes for open-source code have added a simple but overdue defence: time.

GitHub and the Python Package Index, known as PyPI, both announced changes this week that force a pause between when a new software package appears and when it can be pulled into other people's projects. The goal is to blunt supply-chain attacks, where criminals sneak malicious code into a legitimate library that thousands of other applications depend on. BleepingComputer first reported the changes.

Why add a delay at all?

Detection is fast, but cleanup is slow. Security researchers often flag a poisoned package within minutes of it going live. Getting it removed, and warning everyone who already downloaded it, takes far longer. Automated tools happily pull the malicious version into production code in that gap.

Recent examples make the point. The chalk and debug npm attacks, together with the Shai-Hulud and GhostAction campaigns, all relied on that short window between publication and removal. We covered the credential-hijacking behind two of those JavaScript poisonings on 15 July.

What has Dependabot changed?

Dependabot is GitHub's automated helper. It reads a project's list of dependencies, spots when a newer version of a library is available, and opens a pull request, essentially a suggested code change, asking the maintainer to upgrade.

Starting now, Dependabot waits 72 hours before doing that for a newly published version. GitHub calls this a cooldown and says three days is a reasonable middle ground between security and staying current. Teams that want a different wait can change the setting themselves.

GitHub was frank about the limits. A cooldown does nothing against attackers who play the long game and only activate malicious code weeks after publishing. For that, the company points to lockfiles (which pin dependencies to exact versions), tokens with narrow permissions, and turning off install scripts that aren't needed during automated builds.

What has PyPI changed?

PyPI will now reject any new file uploaded to a package release that's more than 14 days old. This closes off release poisoning, where an attacker who steals a maintainer's publishing token quietly attaches malicious files to an old, trusted version that thousands of projects already rely on.

PyPI's own data showed that almost no legitimate project uploads new files to a release more than two weeks after it went out. No confirmed attack has used this exact technique on PyPI yet. The platform's closing the door before anyone walks through it, a posture worth watching given that fake payment SDKs on PyPI were harvesting developer credentials as recently as 8 July.

The changes at a glance

Should you worry?

If you maintain code that pulls from npm or PyPI, the cooldown's a floor, not a ceiling. Pin your dependencies with a lockfile. Give your CI tokens the smallest possible scope. Turn off install-time scripts you don't actually need, a step npm 12 made the default on 9 July. Review Dependabot pull requests before merging, rather than letting a bot auto-approve its own suggestions.

For ordinary users there's nothing to do. Both measures are modest, and sophisticated attackers will simply wait them out. But they raise the floor, and right now the floor is very low.