GitHub and PyPI Add Time-Based Safeguards Against Supply-Chain Attacks
Summary
GitHub now applies a default 72-hour Dependabot cooldown, while PyPI blocks new files added to releases more than 14 days old. The measures aim to limit malicious dependency updates and release poisoning.
Key points
- Dependabot now delays dependency updates by a default of 72 hours to reduce the chance of automatically adopting newly published malicious packages.
- Users can configure a shorter or longer Dependabot cooldown.
- GitHub recommends lockfiles, restricted-scope tokens, and disabling unnecessary CI installation scripts; it says the cooldown does not address longer-term compromises.
- PyPI blocks maintainers from adding new files to a release more than 14 days after publication, aiming to prevent attackers from poisoning older releases.
- PyPI says only a very small percentage of projects legitimately upload files more than two weeks after release, and no known past PyPI attacks have been confirmed to use this release-poisoning technique.
- The changes follow attacks including chalk, debug, s1ngularity, Shai-Hulud, and GhostAction.
Article Details
- Event Type
- GitHub and PyPI introduced time-based safeguards against software supply-chain attacks.
- Impact
- Dependabot now applies a default 72-hour delay to dependency updates, reducing the chance that newly published malicious packages are adopted automatically. PyPI blocks adding files to a release more than 14 days after publication, limiting release poisoning using compromised publishing tokens or workflows. PyPI said no known past attacks had been confirmed to use this technique; the measure is preventive.
Vendors
Products
DependabotGitHub and PyPI have added time-based safeguards to make supply-chain attacks harder, with Dependabot now using a default three-day cooldown and PyPI blocking new files on releases older than 14 days.PyPIGitHub and PyPI have added time-based safeguards to make supply-chain attacks harder, with Dependabot now using a default three-day cooldown and PyPI blocking new files on releases older than 14 days.