GitHub and PyPI (Python Package Index) have introduced a time-based mechanism in the Dependabot dependency management tool to protect against supply-chain attacks and to limit their impact.
Specifically, Dependabot comes with a default three-day cooldown setting, while PyPI will reject new files uploaded to releases older than 14 days.
The measure comes after the two development ecosystems experienced multiple high-profile attacks over the past year. Some notable examples include the ‘chalk’ and ‘debug’ attacks, the “s1ngularity” operation, the Shai-Hulud campaign, and the GhostAction supply-chain attack.
GitHub announced last month changes to tackle supply chain threats, and the hardening process continues with these new measures.
GitHub Adds Dependabot Cooldown
Dependabot is GitHub’s dependency-update service that reads files containing information about new package versions and opens update pull requests to notify software maintainers.
The tool now delays the package update process for 72 hours to reduce the risk of automatically adopting newly published malicious packages.
In many recent cases, malicious npm packages were detected and flagged by security tools within minutes of being published. However, quick detection alone does not remove the threat, as repository maintainers and vendors must still take action to remove the packages, leaving a window during which developers and projects may download and incorporate the malicious code.
While GitHub explained that the three-day period was chosen as a balanced point between avoiding risky releases and keeping up with the latest upgrades, users still have the option to configure a shorter or longer delay through Dependabot’s cooldown configuration option.
GitHub highlighted Dependabot’s limitations against longer-term compromise, recommending the use of lockfiles for dependency pinning, restricted-scope tokens, and disabling unnecessary installation scripts in CI.
PyPI Blocks Release Poisoning with 14-Day Cutoff
PyPI announced that it now blocks maintainers from adding new files to a package release after 14 days have passed since its publication.
The measure is intended to prevent attackers who compromise publishing tokens or workflows from poisoning old, trusted releases. The platform found that only a very small percentage of projects legitimately uploaded files more than two weeks after publishing a release.
No known past attacks on PyPI have been confirmed to use this release poisoning technique, but the platform is acting preventatively to close off a potentially dangerous attack vector before it can be exploited.
