Source: www.bleepingcomputer.com/news/secu… (BleepingComputer, 26 Jul 2026)
GitHub and PyPI have deployed simple time-based controls to shrink the window in which newly published malicious packages can be automatically adopted. Dependabot now applies a default 72-hour cooldown before opening update PRs for new package versions, giving security scanners and maintainers time to detect and remove malicious releases. Users can shorten or lengthen the delay via configuration. Separately, PyPI now rejects any new files uploaded to a release that is more than 14 days old, closing a potential “release-poisoning” path in which an attacker with a stolen token could quietly add malware to an already-trusted version.
These measures follow a string of high-profile incidents (chalk/debug, s1ngularity, Shai-Hulud, GhostAction). GitHub notes the cooldown is not a complete defense against longer-term compromises and continues to recommend lockfiles, least-privilege tokens, and disabling unnecessary install scripts. PyPI observed that legitimate late uploads after 14 days are rare, so the restriction imposes minimal friction while blocking a dangerous technique that has not yet been widely exploited on the platform.
