GitHub and PyPI Introduce Time Delays to Reduce Supply-Chain Risk

GitHub and the Python Package Index (PyPI) are adding time-based safeguards designed to limit the damage caused by newly published or modified malicious packages. The changes follow a series of supply-chain incidents affecting popular open-source ecosystems, including attacks involving npm and PyPI projects.

Dependabot adds a three-day waiting period

GitHub’s Dependabot dependency-management service now applies a default 72-hour cooldown before proposing updates for newly released packages. The delay gives security researchers, automated scanning systems and maintainers more time to identify suspicious releases before they are pulled into projects through automated update workflows.

Recent attacks have shown that malicious packages can be published and downloaded quickly, while detection and removal often take longer. GitHub described the three-day period as a compromise between reducing exposure to unsafe releases and allowing developers to receive important updates without excessive delay. Organizations can change the setting to use a shorter or longer cooldown based on their risk tolerance and development processes.

GitHub also cautioned that the feature is not intended to address every form of dependency compromise. It recommends combining the delay with lockfiles, narrowly scoped access tokens and the disabling of unnecessary package-installation scripts in continuous-integration environments.

PyPI restricts changes to older releases

PyPI has introduced a separate control aimed at preventing attackers from tampering with established package versions. Maintainers can no longer upload new files to a release once 14 days have passed since that release was published.

The policy is intended to reduce the risk of “release poisoning,” in which an attacker who gains access to a maintainer’s publishing credentials or workflow adds a malicious file to an older version that users already trust. PyPI said legitimate uploads made more than two weeks after publication are uncommon, allowing the restriction to address a potential attack path with limited disruption.

PyPI said it has not confirmed that a previous attack used this specific technique, framing the change as a preventive measure. Together, the GitHub and PyPI controls add time for review and detection, but developers will still need layered safeguards such as pinned dependencies, protected publishing credentials and continuous monitoring.