By ByteBot
Within eight days in July, GitHub and PyPI independently reached the same conclusion: the best defense against fast-moving supply chain attacks is to slow automation down. GitHub added a default three-day cooldown to Dependabot version updates on July 14. PyPI froze package release file lists after 14 days on July 22. Together, they close two distinct windows attackers have been exploiting to turn your CI/CD pipeline against you.
Why Your Build Pipeline Was the Attack Surface
Last September, an attacker phished credentials from a maintainer of several popular npm packages and published poisoned versions of chalk, debug, and roughly a dozen others. Those packages see over two billion weekly downloads combined. The payload was surgical: code that silently rewrote cryptocurrency wallet addresses inside any browser application that loaded the affected versions. The malicious releases stayed live for about two hours before the community caught them and registries pulled them down.
Two hours sounds fast. But for automated tooling, two hours is an eternity. Dependabot without a cooldown would have opened a PR the moment the new version hit npm. A team with auto-merge enabled could have shipped the poisoned code to production before anyone flagged the package as malicious. That is the specific failure mode these new policies target.
What GitHub Changed: The Dependabot Cooldown
Starting July 14, Dependabot picks the latest version published at least three days ago instead of the absolute latest. If a malicious release ships today, Dependabot will ignore it entirely for 72 hours — enough time for community detection, registry scanning, and advisory publication to do their work.
The cooldown applies only to version updates, the routine “keep things current” PRs. Security updates — the ones triggered by a known CVE or advisory — still fire immediately. That distinction matters: you do not want a three-day delay on a critical patch.
No configuration change is required. The cooldown is on by default. If you want to customize it, the cooldown key in .github/dependabot.yml gives you full control:
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "daily"
cooldown:
default-days: 3 # default; omit for same effect
To disable the cooldown entirely for a trusted internal registry, set default-days: 0. The feature covers all Dependabot-supported ecosystems on GitHub.com and will ship in GitHub Enterprise Server 3.23.
What PyPI Changed: Frozen Releases After 14 Days
PyPI’s change targets a different but related threat: release poisoning. An attacker who compromises a project’s publishing token cannot write a new version — that would be immediately visible. But until now, they could silently inject a malicious wheel or sdist into an existing, trusted release. Users pinned to version 1.4.2 would pull the new file without knowing anything had changed.
As of July 22, that window is closed. Releases reject new file uploads after 14 days from first publication. PyPI analyzed 15,000 projects and found only 56 had legitimately uploaded files to a release after the two-week mark. Legitimate impact is minimal. If you need to support a new Python version and your release is more than 14 days old, cut a new patch version instead.
Notably, no confirmed PyPI attack has actually used release poisoning yet. PyPI deployed this proactively — infrastructure teams rarely get credit for closing doors before they get kicked in.
What These Defenses Do Not Cover
GitHub product manager Carlin Cherry was direct about the limits: “It does little against attacks that play a longer game, including backdoors planted in releases and left dormant.” A three-day window is useless against an attacker willing to wait a week. Both measures only address the fast-strike pattern where a malicious version ships, spreads, and gets caught within hours.
Layered defense still matters. Beyond these platform controls, teams should be pinning dependencies with lockfiles, restricting install scripts in CI, and scoping build pipeline tokens to minimum permissions. And if you have been auto-merging Dependabot PRs without review — that has always been a mistake, cooldown or not.
The Numbers Behind the Decision
GitHub’s Advisory Database cataloged over 6,500 npm malware advisories in the year ending May 2026 — about 18 newly identified malicious packages every single day. GitHub reviewed 21 major supply chain incidents from 2018 to 2026 and found a consistent pattern: malicious versions are typically detected within hours. Three days as a buffer makes statistical sense.
The supply chain threat has shifted from attackers publishing obviously sketchy new packages to compromising real maintainer accounts and poisoning packages developers already trust. Time-based defenses are a direct response to that shift: they do not try to detect malicious code algorithmically; they give humans and automated scanners time to act before automation ships the update. Similar time-based protections are now spreading across VS Code, Ruby, Bun, npm, pnpm, and Yarn — this is becoming the industry standard response to supply chain speed.
