GitHub and PyPI Introduce Time-Based Defenses Against Supply Chain Attacks
GitHub and PyPI have activated new time-based barriers to slow down supply chain attacks. Dependabot now waits a default of 72 hours before proposing version updates, while PyPI rejects new files added to releases older than 14 days.
The platforms introduced the changes in recent weeks with a shared goal: inserting time delays to reduce the typical damage from supply chain attacks. In Dependabot, the GitHub bot for managing dependencies, the update appears as a default 72-hour wait before opening a pull request when a new package version is released.
In PyPI, the central repository for the Python ecosystem, the platform has rejected uploads of new files since July if the release was published more than 14 days earlier. The Dependabot adjustment does not aim to block urgent patches. The wait applies only to version updates that are not considered security-related. Security updates remain immediate to avoid penalizing critical fixes when risk is already identified.
The objective is to prevent a project from absorbing a freshly published version within minutes that has not yet passed the community’s natural filter, or that an attacker may have inserted after compromising an account or publication workflow. Teams relying on automation will notice the change in cadence. The wait can be adjusted or disabled with the cooldown option in the dependabot.yml file, which is relevant for repositories with strict maintenance windows or their own validation processes. GitHub Enterprise Server will also incorporate the feature, with deployment planned for GHES 3.23.
In PyPI, the 14-day restriction targets a tactic that has caused problems: poisoning of older and stable versions. If an attacker obtains publication tokens or access to a poorly protected CI/CD pipeline, they can attempt to upload a new artifact to a past version with the same number but different content. This complicates audits and breaks basic assumptions in many build environments. The change was integrated on July 8 2026 and was adopted after debate returned to the forefront in March following compromises in projects such as LiteLLM and Telnyx linked to a mutable reference when using the GitHub Action Trivy.
PyPI acknowledges that the ecosystem still lacks standardized semantics and APIs to declare whether a release is open or closed. The platform anticipates progress through initiatives such as Upload 2.0 API and Staged Previews, which should enable more secure workflows without relying solely on rigid rules.
Related articles
Linux Foundation Report Reveals Why Companies Fork Open Source Projects and Maintain Internal Patches
A new Linux Foundation Research study of 567 IT professionals shows that organizations actively modify open source components rather than using them unchanged. While 72% contribute back to projects in some form, many maintain internal forks due to missing features, integration needs, security timelines, and regulatory requirements. The average organization supports 86 internal forks, consuming over 5,000 hours per release cycle. The largest gaps between business-critical technologies and actual contributions appear in programming languages and databases. The findings highlight growing supply-chain risks when internal branches diverge from upstream projects without proper tracking of patches and commits.
Where Secrets Really End Up in Docker Images: Testing 8 Common Methods
A detailed analysis of eight different approaches for handling secrets during Docker image builds reveals that most methods leave sensitive data exposed in layers, configuration files, or build history. Experiments conducted on Ubuntu 24.04.1 LTS with Docker Engine 29.1.3 and BuildKit v0.26.2 showed that simply using RUN rm after COPY or overwriting files fails to remove secrets from immutable layers. Environment variables via ENV and build arguments via ARG both persist in image metadata and history. Only BuildKit Secrets with --mount=type=secret and multi-stage builds that avoid copying secrets into the final stage successfully prevent leakage. The study demonstrates that secrets can be extracted from saved images without running any containers. Developers are advised to adopt these two secure patterns to protect credentials in container supply chains.
Mozilla Revokes GPG Signing Key After Accidental Upload to Private GitHub Repository
Mozilla has replaced the GPG key used to sign certain Firefox and Thunderbird builds following an accidental exposure of the unencrypted secret key in a private GitHub repository. The key was intended for signing Linux archives, RPM packages, and checksum files, raising theoretical risks of supply-chain attacks through forged installers. Company audits found no evidence of external misuse, as repository access was limited to a small group of employees who already held legitimate access to the key. Most users require no action, though those manually verifying GPG signatures must import the new key along with revocation data for the old one. Linux administrators installing Firefox via RPM packages on distributions such as Fedora, RHEL, Rocky Linux, AlmaLinux, openSUSE, and SUSE may need to manually update the key to avoid installation failures. Thunderbird users are unaffected by the RPM issue since no official RPM packages are released for the email client. The new key remains valid until August 5, 2028, with public details available in updated KEY files and on keys.openpgp.org.
ChainDrop Malware Infects Over 1,300 npm Packages in Record Supply Chain Poisoning Campaign
Security researchers have uncovered a massive supply chain attack involving the ChainDrop malware that compromised more than 1,300 npm packages with a combined 2 billion monthly downloads. The malicious code silently steals npm tokens, GitHub credentials, and SSH keys before using stolen tokens to infect additional packages in a self-propagating loop. In a parallel incident, the Open VSX marketplace removed 77 malicious extensions that impersonated popular developer tools and harvested host and repository data. Attackers have also begun exploiting AI coding assistants through a technique called HalluSquatting, registering packages that match hallucinated names suggested by tools such as GitHub Copilot and Claude Code. The incidents highlight how modern supply chain threats now extend beyond direct dependencies to include AI-generated recommendations and automated publishing pipelines. Experts recommend strict lockfile usage, minimal token permissions, and manual verification of any package suggested by AI assistants.