Back Feeds.4Sysops

GitHub and PyPI add delays to slow supply

Feeds.4Sysops •IT News • July 26, 2026

GitHub and PyPI are adding time-based barriers that make it harder for malicious package releases to reach developers immediately or be inserted into trusted versions later. GitHub’s Dependabot, the service that opens pull requests for dependency updates, now waits 72 hours by default before proposing a newly published version. That pause gives security scanners and maintainers time to identify and remove compromised packages before automated updates spread them. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GitHub and PyPI Implement Time-Based Defenses Against Supply-Chain Attacks GitHub and PyPI have introduced time-based mechanisms in their dependency management tools to mitigate supply-chain attacks. GitHub's Dependabot now includes a default 72-hour delay before proposing updates, allowing time for security scans to identify malicious packages. PyPI has implemented a 14-day restriction on adding new files to existing releases to prevent attackers from poisoning trusted packages. These measures follow a series of high-profile attacks in the past year, including the compromise of popular npm packages like chalk and debug. The changes aim to reduce the window of opportunity for attackers and enhance overall security in software development ecosystems. GitHub recommends additional security practices, such as using lockfiles and restricted-scope tokens, to further protect against long-term compromises. No past attacks on PyPI have exploited the new 14-day rule, but it is a proactive measure against potential threats. 7 sources 52

Extracted Entities

GitHub and PyPI add delays to slow supply

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (2)