GitHub and PyPI add time-delay defenses against supply chain attacks

GitHub and the Python Package Index (PyPI) have each introduced time-based defenses this week aimed at slowing down supply chain attacks that exploit the speed of automated dependency updates. GitHub's Dependabot now delays adopting new package versions by 72 hours by default, while PyPI has started rejecting new file uploads to package releases older than 14 days.

Both changes target the same underlying weakness: security tools can flag a malicious package within minutes of publication, but detection alone doesn't remove the threat. Maintainers still have to act on the alert, and in the meantime, automated tooling like Dependabot can pull the compromised package into production before anyone notices.

Why now

The moves follow a string of high-profile incidents on both ecosystems over the past year, including the 'chalk' and 'debug' npm package hijackings — which together affected packages with a combined 2 billion weekly downloads — the AI-powered s1ngularity malware campaign that hit 2,180 GitHub accounts, the Shai-Hulud attack that shipped signed malicious packages disguised as TanStack and Mistral libraries, and the GhostAction campaign that forced PyPI to invalidate stolen publishing tokens. GitHub had already announced a broader set of npm security changes last month; this week's Dependabot cooldown extends that hardening effort.

How the defenses work

Dependabot's new 72-hour cooldown period delays the pull requests it opens for new dependency versions, giving the security community time to detect and flag malicious releases before automated tooling adopts them. GitHub said three days was chosen as a balance between security and staying current with legitimate updates, and the delay is configurable — maintainers can shorten or lengthen it. GitHub also recommended pairing the cooldown with lockfiles for dependency pinning, restricted-scope publishing tokens, and disabling unnecessary installation scripts in CI pipelines, since the cooldown alone doesn't defend against longer-term account compromise.

PyPI's change targets a different attack pattern: an attacker who compromises a maintainer's publishing token or CI workflow long after a package version has shipped and gained developer trust. By blocking new file uploads to any release older than 14 days, PyPI closes the window for this kind of "release poisoning," where a trusted, already-adopted release gets quietly modified after the fact. PyPI noted that no confirmed past attack has used this specific technique — the platform is acting preventatively, having found that only a small fraction of projects legitimately upload files more than two weeks after a release.

What this means for developers

For most projects, the practical effect is a short delay before automated dependency PRs appear, and no ability to patch old package releases in place after two weeks. Neither change requires developer action to benefit from it — both are enabled by default at the platform level — though maintainers with unusual release workflows may need to adjust Dependabot's cooldown setting if the 72-hour default conflicts with their update cadence, as first reported by BleepingComputer.