GitHub and PyPI Introduce “Time-Based Holds” Against Supply-Chain Attacks

GitHub and the Python package repository PyPI have rolled out mechanisms based on time delays to make supply-chain attacks harder to pull off and to limit their fallout. The core idea is simple: if some time passes between a package being published and its automatic adoption, defenders get a chance to spot and neutralize the malware before it spreads across projects.

The measures didn't come out of nowhere. Over the past year, both ecosystems weathered a string of high-profile incidents — attacks on the chalk and debug packages, the “s1ngularity” operation, the Shai-Hulud campaign, and the GhostAction affair. Last month GitHub already announced changes to npm security, and the current additions continue that same course toward tighter controls.

A pause in Dependabot

Dependabot is a GitHub service that tracks the release of new package versions and opens a pull request on its own proposing an update. Now, by default, it waits 72 hours before suggesting a fresh version. The reasoning is that malicious npm packages are often flagged by defensive tools within minutes of publication, but rapid detection alone doesn't save the day: the package still has to be removed from the repository, and until that happens, developers keep pulling it in.

GitHub calls the three days a compromise between caution and the desire to keep up with updates. The value is configurable: the cooldown parameter lets you shorten or lengthen the delay. At the same time, the company candidly notes that the pause offers no protection against long-term compromise, and it recommends additionally using a lockfile to pin versions, tokens with limited permissions, and disabling unnecessary install scripts in CI.

PyPI locks down old releases

PyPI took a different route and now prohibits adding new files to a release once more than 14 days have passed since it was published. This way the platform hedges against a scenario in which an attacker who has seized a publishing token or workflow “poisons” an old, already trusted release by slipping malicious files into it. According to PyPI's own figures, legitimately supplementing a release two weeks after publication is something only a negligible fraction of projects ever need to do.

Tellingly, no confirmed attacks of exactly this type on PyPI have been recorded so far — the platform is acting preemptively, closing off a dangerous avenue before anyone puts it to use.

Source: Bleeping Computer