GitHub, PyPI Introduce Time-Based Protections Against Supply Chain Attacks
GitHub’s Dependabot now enforces a 72-hour cooldown before merging updates, while PyPI blocks new file uploads to releases older than 14 days, both aiming to block quick-strike supply chain threats.
GitHub and the Python Package Index (PyPI) have rolled out time-based safeguards to harden their ecosystems against supply chain attacks. The new measures introduce mandatory delays that aim to close the window of opportunity for attackers who rapidly publish malicious packages or attempt to poison already trusted releases. These changes come as both platforms continue to face sophisticated campaigns that exploit automated dependency management.
GitHub’s Dependabot, the automated dependency update tool, now defaults to a 72-hour cooldown before it can open a pull request for a newly published package version. The logic is straightforward: many malicious npm packages are detected by security scanners within minutes of publication, but removal is not instantaneous. By waiting three days, developers avoid automatically pulling in code that might later be flagged and withdrawn. While the delay is a compromise between security and timeliness, GitHub has made the cooldown configurable, allowing teams to shorten or extend it as needed. The platform also stresses that cooldowns alone are not a silver bullet and recommends using lockfiles for precise version pinning, limiting token scopes, and disabling unnecessary installation scripts in CI pipelines.
PyPI, on the other hand, now blocks maintainers from uploading new files to any release that is older than 14 days. This prevents a scenario where an attacker who compromises a publishing token or workflow can silently append malicious code to a long-standing, widely trusted release. PyPI’s analysis shows that legitimate late uploads are exceptionally rare, so the cutoff is unlikely to disrupt normal development. Although no known attacks have leveraged this exact technique against PyPI, the measure is preventive, addressing a dangerous possibility before it can be abused.
For website owners and businesses that depend on WordPress plugins, themes, or custom Python backends, these changes underscore the importance of layered defenses. Automated updates can introduce risk if a compromised package slips through, and trusting a release’s age is no longer sufficient proof of integrity. A managed hosting environment that audits and staggers updates—like AEU Hosting’s secured WordPress platform—adds an extra layer of protection by vetting changes before they reach production, helping to block tainted code that might otherwise slip past package registry defenses.