GitHub and PyPI announced simultaneous structural changes targeting package registry supply chain attacks: a default 72-hour Dependabot cooldown that delays automatic dependency updates and a PyPI restriction blocking maintainers from adding files to releases older than 14 days.
GitHub’s 72-Hour Dependabot Cooldown Targets Rapid Post-Publication Poisoning
GitHub introduced a default 72-hour cooldown to Dependabot’s dependency update mechanism. When a new package version is published to a registry, Dependabot now waits at least three days before opening a pull request to adopt the update in any repository it monitors. Developers and organizations can configure shorter or longer cooldown windows through Dependabot’s settings, but the default is 72 hours. The change targets the attack window between a malicious package’s publication and its automatic adoption into downstream repositories — a window that was previously zero for any team running Dependabot with immediate updates enabled.
Research that helped motivate the cooldown showed that malicious npm packages were detected and flagged by security tools within minutes of being published. A 72-hour default window gives those detection tools time to identify, flag, and block a malicious package before Dependabot opens a pull request to import it. Under the previous zero-delay behavior, automated tools could pull a malicious package into a repository and trigger a CI/CD pipeline build before any detection infrastructure had processed the new publication.
How the Shai-Hulud and s1ngularity Operations Motivated the Three-Day Default
The Dependabot change followed multiple high-profile supply chain attacks, including the ‘chalk’ and ‘debug’ npm package hijackings, the s1ngularity operation, the Shai-Hulud campaign that poisoned bioinformatics PyPI packages, and the GhostAction supply chain attack. These incidents demonstrated a common attack pattern: compromise a package maintainer’s credentials or token, publish a malicious new version, and rely on automated dependency management tools to pull the update into downstream targets before detection occurs. The 72-hour cooldown structurally disrupts the final step of that pattern.
Why Detection Within Minutes of Publication Justifies the Cooldown Window
The rationale for the 72-hour default rests on the detection speed documented in supply chain attack research. If security tooling can identify a malicious package within minutes of publication, a three-day delay before automated adoption provides a detection window approximately 4,000 times longer than the gap a zero-delay update would offer. The cooldown does not guarantee detection — a sophisticated attacker could publish a package that evades detection for longer — but it changes the dynamic from a race that favors the attacker to one that gives defenders meaningful time to respond.
PyPI’s 14-Day Release Lock Closes the Token Compromise File-Injection Path
PyPI implemented a complementary measure targeting “release poisoning” — the attack technique in which an adversary compromises a package maintainer’s token and retroactively adds malicious files to an existing, already-trusted package release rather than publishing a visible new version. Under PyPI’s change, maintainers are blocked from adding new files to any release that is older than 14 days.
The attack path this targets is particularly dangerous because it operates invisibly within established package versions. Users who pin a specific version in their dependency file — a common security practice intended to prevent unexpected updates — are typically not expecting that pinned version to change. A retroactive file addition to a stable release can inject malicious code into every organization pinning that version without any of them receiving a notification of a version bump or a Dependabot-style update proposal. The PyPI 14-day restriction makes this attack path structurally unavailable for any release that has aged past the window, which covers the vast majority of stable package versions in active production use.
Together, the GitHub and PyPI changes represent the most significant structural supply chain defenses these ecosystems have deployed since the introduction of two-factor authentication requirements for package maintainers — addressing two distinct attack vectors that prior technical controls did not reach.
