GitHub and PyPI Introduce Time-Based Defenses Against Supply Chain Attacks
GitHub and PyPI have activated new time-based barriers to slow down supply chain attacks. Dependabot now waits a default of 72 hours before proposing version updates, while PyPI rejects new files added to releases older than 14 days.
The platforms introduced the changes in recent weeks with a shared goal: inserting time delays to reduce the typical damage from supply chain attacks. In Dependabot, the GitHub bot for managing dependencies, the update appears as a default 72-hour wait before opening a pull request when a new package version is released.
In PyPI, the central repository for the Python ecosystem, the platform has rejected uploads of new files since July if the release was published more than 14 days earlier. The Dependabot adjustment does not aim to block urgent patches. The wait applies only to version updates that are not considered security-related. Security updates remain immediate to avoid penalizing critical fixes when risk is already identified.
The objective is to prevent a project from absorbing a freshly published version within minutes that has not yet passed the community’s natural filter, or that an attacker may have inserted after compromising an account or publication workflow. Teams relying on automation will notice the change in cadence. The wait can be adjusted or disabled with the cooldown option in the dependabot.yml file, which is relevant for repositories with strict maintenance windows or their own validation processes. GitHub Enterprise Server will also incorporate the feature, with deployment planned for GHES 3.23.
In PyPI, the 14-day restriction targets a tactic that has caused problems: poisoning of older and stable versions. If an attacker obtains publication tokens or access to a poorly protected CI/CD pipeline, they can attempt to upload a new artifact to a past version with the same number but different content. This complicates audits and breaks basic assumptions in many build environments. The change was integrated on July 8 2026 and was adopted after debate returned to the forefront in March following compromises in projects such as LiteLLM and Telnyx linked to a mutable reference when using the GitHub Action Trivy.
PyPI acknowledges that the ecosystem still lacks standardized semantics and APIs to declare whether a release is open or closed. The platform anticipates progress through initiatives such as Upload 2.0 API and Staged Previews, which should enable more secure workflows without relying solely on rigid rules.
Related articles
Fake Terraform Providers on HashiCorp Registry Distribute Go Malware to Developers
Cybersecurity researchers have identified Go-based malware distributed through two fake Terraform providers and two Go modules hosted on the official HashiCorp registry. The providers gocommunity-io/dockerd and kreuzwenker/docker, along with modules gocommunity.io/orderedbtree and gogets.dev/btreex, impersonate legitimate projects and represent the first documented case of malicious code being delivered via the HashiCorp registry. Attackers approach developers on LinkedIn, Facebook, and job forums using fake Web3 company profiles, then supply seemingly harmless repositories whose malicious behavior is triggered through npm or PyPI dependencies. Once executed, the malware collects hardware attributes, operating system data, hostname, and node availability before sending the information to attacker infrastructure. Command and control relies on a Slack channel polled every ten seconds and encrypted commands read from Sepolia testnet Ethereum smart contracts every three seconds, with each infected client using ephemeral key pairs for targeted delivery. The code matches the Graphalgo campaign previously documented by ReversingLabs and attributed to North Korean actors.
Challenges in Building Accurate SBOMs for C and C++ Projects Highlighted by CodeScoring Analysis
C and C++ ecosystems lack centralized package manifests, making SBOM generation far more complex than in Python, Java, or JavaScript. Libraries may arrive through system package managers like apt or dnf, build tools such as Conan and vcpkg, or direct source inclusion, with no single record of all components. CodeScoring’s Johnny agent uses eBPF to observe linker commands during builds and cross-references results with dpkg, RPM, and pkg-config metadata. The analysis distinguishes build-time SBOMs, which capture static libraries and compilation commands, from runtime SBOMs that reflect dynamic dependencies at execution. When version data cannot be verified, components are explicitly marked unresolved rather than guessed. The approach also addresses header-only libraries and patched artifacts that defeat simple hash matching.
CrowdSec Confirms Theft of Source Code from Roughly 300 GitHub Repositories via TanStack Supply Chain Attack
French cybersecurity firm CrowdSec has confirmed that attackers stole source code from approximately 300 GitHub repositories, including around 170 private ones. The breach occurred in May 2026 through a compromised TanStack component that exfiltrated an API key with read access to the private codebase. The stolen material included code for the company's SaaS console, AWS procedures, connectors, and automation tools, while the remaining repositories contained already-public open source code. No customer data, passwords, organization details, tokens, or other secrets were included in the leak, and all potentially affected credentials were immediately rotated. CrowdSec stated that the code is tightly integrated with internal systems and has largely changed over the past four months, reducing its usefulness outside the company's environment. The SaaS service code undergoes regular audits, and the company sees no immediate threat from the exposure while the investigation continues.
Dependency Confusion Attacks Let Attackers Hijack Internal Library Names in Corporate Builds
A widespread supply chain risk allows attackers to publish packages with internal company names on public registries such as npm and PyPI, causing build systems to pull malicious versions instead of internal ones. The attack works because package managers treat multiple registries as a single list and select the highest version number, with no inherent priority for internal sources. Researcher Alex Birsan demonstrated the technique in February 2021 by registering names harvested from open repositories and error messages, successfully injecting packages into builds at Microsoft, Apple, PayPal, Shopify, Netflix, Tesla and Uber. The malicious code executes during installation because setup scripts and lifecycle hooks run with the privileges of the build agent, exposing environment variables, tokens and internal network access. Mitigation requires a single internal proxy repository that never mixes public responses for internal package names, scoped namespaces bound to private registries, lock files with content hashes, and disabling install scripts where possible. The technique remains effective against any organization that lists both internal and public registries in its build configuration.