GitHub and PyPI Roll Out Time-Based Defenses to Thwart Supply-Chain Attacks

GitHub's Dependabot now includes a configurable three-day cooldown before updating packages, while PyPI blocks new file uploads to releases older than 14 days, as the industry shifts toward proactive automated safeguards.

This article was drafted with AI assistance from multiple sources and was reviewed and approved by a human editor before publication.

GitHub and PyPI have introduced time-based defenses to combat supply-chain attacks, reflecting a broader industry shift toward proactive, automated safeguards following a wave of high-profile incidents.

GitHub announced changes last month to tackle supply chain threats. Its Dependabot tool now has a default three-day cooldown before updating packages. The cooldown period is configurable via a 'cooldown' option, allowing organizations to adjust the delay as needed. GitHub also recommends additional defenses such as lockfiles, restricted-scope tokens, and disabling unnecessary CI scripts to further secure the software supply chain.

PyPI, the Python Package Index, now blocks new file uploads to releases older than 14 days. This measure prevents attackers from pushing malicious updates to old versions that users might still rely on. While no known past PyPI attacks used the specific release poisoning technique that the 14-day cutoff blocks, the move is seen as a preventative step. According to PyPI, only a very small percentage of projects legitimately upload more than 14 days after release, so the impact on legitimate workflows is minimal.

These measures follow past high-profile attacks including chalk, debug, s1ngularity, Shai-Hulud, and GhostAction, which exploited weaknesses in package management ecosystems. The new time-based controls aim to reduce the window of opportunity for attackers to inject malicious code into widely used packages.