Time-Based Defences: GitHub and PyPI Slow Down Supply Chain Attacks

Why Time Is the New Defence in Software SecurityIn the ongoing battle against supply chain attacks, two major platforms have introduced a simple yet p...

Why Time Is the New Defence in Software Security

In the ongoing battle against supply chain attacks, two major platforms have introduced a simple yet powerful concept: delay. GitHub and PyPI have both implemented time-based barriers that give the community breathing room to spot malicious activity before it spreads. These changes reflect a growing recognition that speed can be an attacker's best ally, and that slowing down automated processes can significantly reduce risk.

Dependabot's 72-Hour Cooldown: A Pause for Thought

GitHub's Dependabot, the automated dependency management tool, now waits a default of 72 hours before opening pull requests for version updates. This cooldown period applies only to routine version bumps, not to security updates, which remain immediate. The rationale is straightforward: a newly released package version might contain undiscovered vulnerabilities or could even be a malicious upload from a compromised account. By forcing a pause, GitHub gives the broader community time to vet the release, reducing the likelihood that your project automatically adopts a dangerous update.

For development teams, this means adjusting expectations. Automated pull requests will no longer appear instantly when a new version is published. However, the cooldown is configurable via the cooldown option in the dependabot.yml file, allowing teams with strict maintenance windows or custom validation processes to tailor the delay to their needs. GitHub Enterprise Server will also receive this feature in version 3.23.

PyPI's 14-Day Window: Closing the Door on Version Poisoning

On the Python Package Index (PyPI), a different time-based defence has been enacted. As of July 8, 2026, PyPI rejects any attempt to upload new files to a release that is more than 14 days old. This measure targets a tactic known as "version poisoning," where attackers who compromise publishing credentials or CI/CD pipelines add malicious files to an older, stable release. Such actions can corrupt audits and break assumptions in build environments, as seen in incidents involving projects like LiteLLM and Telnyx earlier this year.

PyPI acknowledges that the ecosystem lacks standardised semantics for whether a release is "open" or "closed." Future initiatives like the Upload 2.0 API and Staged Previews aim to provide more flexible and secure upload mechanisms. In the meantime, maintainers must plan to publish all wheels and artefacts within the 14-day window. If support for a new Python version is needed later, the recommended approach is to release a new package version rather than modify an old one.

Practical Implications for Development Teams

These changes may seem minor, but they have significant implications for how teams manage dependencies and releases. Here are some key takeaways:

Embrace the 72-hour delay for Dependabot version updates. Use this time to run additional tests or manual reviews before merging.
Prioritise security updates – they remain immediate, so ensure your automated processes can distinguish between security and non-security patches.
Configure cooldown periods in dependabot.yml to align with your release cycles and validation requirements.
Strengthen lockfiles and pin dependencies to reduce unexpected changes in your package graph.
Plan PyPI releases carefully – ensure all artefacts are ready within 14 days of the initial release, and avoid the temptation to patch old versions.

Beyond Time Barriers: Essential Hygiene for Supply Chain Security

While these time-based defences are valuable, they are not a silver bullet. The real protection lies in robust security practices: using minimal permissions for tokens, rotating credentials regularly, implementing anti-fraud controls, and maintaining strict CI/CD hygiene. By combining these measures with the new platform-level delays, you can significantly reduce the attack surface and make it much harder for malicious code to slip through unnoticed.

For businesses in Spain and across the EU, where GDPR compliance and data integrity are paramount, adopting these practices is not just a technical necessity but a legal and reputational imperative. Whether you manage a small server fleet or a large hosting infrastructure, staying ahead of supply chain threats requires a proactive approach. Time-based defences are a welcome addition to the security toolkit, but they work best when integrated into a comprehensive security strategy.

Put these ideas into practice

Talk to ALMC about a solution for your business. Explore your options or contact our team.

Results without leaving the page.