GitHub and PyPI have added time-based safeguards to make supply-chain attacks harder, with Dependabot now using a default three-day cooldown and PyPI blocking new files on releases older than 14 days. These changes follow a wave of attacks including chalk, debug, s1ngularity, Shai-Hulud, and GhostAction, and are designed to reduce the impact of compromised publishing workflows. #Dependabot #PyPI #chalk #debug #s1ngularity #ShaiHulud #GhostAction
Keypoints
- GitHub added a default 72-hour cooldown to Dependabot updates.
- The delay helps reduce automatic adoption of newly published malicious packages.
- Users can still configure a shorter or longer cooldown period.
- GitHub recommends lockfiles, restricted-scope tokens, and fewer CI installation scripts.
- PyPI now blocks new files on releases older than 14 days to prevent release poisoning.