StepSecurity Adds Dependabot Grouping and Cooldown Controls
Summary
StepSecurity added group and cooldown controls to centralized Dependabot configuration, allowing teams to batch updates and set PR cadence across supported ecosystems. The company says they complement its npm Package Cooldown check.
Key points
- Dependabot’s group attribute can combine related updates into one PR based on update type, package-name patterns, or dependency scope.
- The cooldown attribute sets a minimum interval between new Dependabot PRs to better match a team’s review capacity.
- StepSecurity offers both controls through centralized configuration and can generate or enhance dependabot.yml files.
- The separate npm Package Cooldown check blocks PRs introducing package versions published within a configurable window; the default is two days, adjustable from one to 30 days.
- StepSecurity says its npm Package Cooldown check blocked attempts to adopt malicious packages during the 2025 Shai-Hulud attack; the company claims customers with the check enabled were shielded from accidentally merging those updates.
- The article cites recent supply-chain incidents, including CanisterWorm, as context for keeping dependency updates reviewable; the incident details and product effectiveness claims are presented by StepSecurity.
Article Details
- Event Type
- StepSecurity announced Dependabot configuration enhancements adding cooldown and group attributes for managing dependency-update timing and batching.
- Impact
- The features are intended to make dependency update pull requests more manageable and reviewable, while the separate npm Package Cooldown check blocks pull requests that introduce package versions published within a configurable window. The article says StepSecurity customers with that check enabled were shielded from accidentally merging malicious npm updates during the 2025 Shai-Hulud attack. It also reports supply-chain incidents involving compromised GitHub Actions and packages, including a CanisterWorm campaign and an axios compromise.
Threat Actors
TeamPCPThe article reports that TeamPCP compromised 76 of 77 Trivy GitHub Action version tags and embedded credential stealers.UNC1069The article says the actor behind the axios compromise was later attributed to the North Korean group UNC1069; this is reported attribution, not independently confirmed in the article.
Malware
Vendors
CheckmarxGitHub Action, embedding credential stealers that harvested secrets from CI/CD runners. Days later, the Checkmarx KICS GitHub Action was hit with the same playbook. The stolen npm tokens from those compromisedGitHubcontrol over how dependency updates are batched and how frequently they arrive, across npm, pip, Docker, GitHub Actions, and other Dependabot supported ecosystems.StepSecurityStepSecurity now supports cooldown and group attributes for Dependabot configuration management. These additions give organizations precise control over how dependency updates are batched and how frequently they arrive,
Products
AxiosThen came the axios compromise. A state-sponsored actor, later attributed to North Korean group UNC1069, hijacked the most popular HTTP client on npm. Over 100 million weekly downloads. Malicious versions published withCheckmarx KICS GitHub Actionembedding credential stealers that harvested secrets from CI/CD runners. Days later, the Checkmarx KICS GitHub Action was hit with the same playbook. The stolen npm tokens from those compromised pipelines fueledDependabotStepSecurity now supports cooldown and group attributes for Dependabot configuration management. These additions give organizations precise control over how dependency updates are batched and how frequently they arrive,NPM Package Compromised Updates Checkensures that the versions being proposed have been published long enough to be vetted. The npm Package Compromised Updates check blocks versions that are known to be malicious. And when an incident does happen, npmnpm Package CooldownIf you are already familiar with StepSecurity's npm Package Cooldown check, which blocks PRs that introduce recently published packages, think of this as the other half of the cooldown story. The npm Package Cooldownnpm Package SearchUpdates check blocks versions that are known to be malicious. And when an incident does happen, npm Package Search tells you exactly which repositories are affected.Policy Driven PRsIf you are already using StepSecurity Policy Driven PRs in your configuration, you can update the Dependabot configuration to include the cooldown and group attributes Trivy GitHub ActionTeamPCP compromised 76 of 77 version tags of the Trivy GitHub Action, embedding credential stealers that harvested secrets from CI/CD runners. Days later, the Checkmarx KICS GitHub Action was hit with the same playbook.