GitHub and PyPI Implement Time-Based Defenses Against Supply-Chain Attacks

GitHub and PyPI have introduced time-based mechanisms in their dependency management tools to mitigate supply-chain attacks. GitHub's Dependabot now includes a default 72-hour delay before proposing updates, allowing time for security scans to identify malicious packages. PyPI has implemented a 14-day restriction on adding new files to existing releases to prevent attackers from poisoning trusted packages. These measures follow a series of high-profile attacks in the past year, including the compromise of popular npm packages like chalk and debug. The changes aim to reduce the window of opportunity for attackers and enhance overall security in software development ecosystems. GitHub recommends additional security practices, such as using lockfiles and restricted-scope tokens, to further protect against long-term compromises. No past attacks on PyPI have exploited the new 14-day rule, but it is a proactive measure against potential threats.

Key Points: • GitHub's Dependabot now has a 72-hour cooldown to prevent immediate adoption of malicious packages. • PyPI restricts new file uploads to existing releases after 14 days to block potential poisoning attacks. • These changes follow multiple high-profile supply-chain attacks in the past year, including npm package compromises.