Loading story…
GitHub and the Python Package Index (PyPI) introduced new time-based protections aimed at slowing the spread of malicious open-source packages and preventing tampering with trusted releases. GitHub added a default 72-hour cooldown for non-security Dependabot updates, delaying automatic pull requests for newly published package versions so suspicious releases have more time to be detected and removed before broad adoption.
PyPI said it will block maintainers from uploading new files to package releases more than 14 days old, a safeguard designed to stop attackers from poisoning long-stable versions after compromising maintainer accounts, tokens, or publishing workflows. PyPI said it has not seen this technique abused to date, but noted there is no technical barrier to it; the restriction is expected to be enforced after the Upload 2.0 API and staged previews are standardized under PEP 694. Both platforms said the changes respond to repeated software supply-chain incidents, while GitHub also urged developers to keep using controls such as lockfiles, scoped tokens, and disabling unnecessary CI install scripts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
PyPI announced a policy to prevent maintainers from adding new files to package releases more than 14 days after publication, aiming to stop attackers from poisoning older trusted versions after account or token compromise.
GitHub introduced a default three-day cooldown before Dependabot automatically proposes non-security updates to newly published packages, intended to reduce rapid adoption of malicious releases in supply-chain attacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcecyberveille.ch
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitHub has changed Dependabot to wait three days before opening pull requests for non-security version updates, aiming to keep fast-moving malicious package releases out of automated developer workflows. The company said the change was driven by repeated software supply-chain incidents in which poisoned npm releases were detected and removed within hours, but still had enough time to be pulled into builds. GitHub pointed to a 2025 npm compromise in which an attacker phished a maintainer and published malicious versions of widely used packages including **`chalk`** and **`debug`**, with code that rewrote cryptocurrency wallet addresses before the packages were taken down roughly two hours later. Security updates tied to known advisories are not delayed and will still be issued immediately. The move aligns with broader industry guidance that the first hours after a package is published are the highest-risk period for dependency consumers. Research cited similar attacks affecting 18 npm packages with more than 2.6 billion weekly downloads and the **Nx** build attack, which remained live for about four hours, reinforcing recommendations to delay automated updates by 24 to 48 hours or longer. GitHub said the npm ecosystem logged more than 6,500 malware advisories in the year ending May 2026 and urged teams to combine cooldowns with other controls, including lockfiles, careful review before merge, scoped CI tokens, disabling install scripts where possible, and pinning dependency versions to reduce supply-chain exposure.
Jul 27, 2026
PyPI has begun rejecting uploads of new files to package releases more than 14 days old, a security change designed to make it harder for attackers to poison long-stable versions after compromising a project's publishing token or CI workflow. The policy was driven in part by supply-chain incidents involving the **LiteLLM** and **Telnyx** packages, whose March 2026 compromises were tied to a mutable reference in the **Trivy GitHub Action**. PyPI maintainers said the operational impact should be limited: analysis found that only 56 of the top 15,000 packages uploaded a Python 3.14-compatible wheel more than 14 days after the original release. The approach gained support during discussions around **PEP 740** and at the 2026 Packaging Summit, where participants favored publishing a new package version instead of modifying an older release; the implementation by Seth Larson was merged on July 8.
Jul 27, 2026
Security reporting from Palo Alto Networks, GitHub, and Cisco Talos shows software supply-chain abuse continuing to intensify, with open-source ecosystems facing rising volumes of vulnerabilities, advisories, and malware. Incident responders said attackers increasingly target developers and build environments because they provide access to source code, CI/CD pipelines, cloud infrastructure, and enterprise endpoints, turning package repositories into an efficient initial-access vector. Cisco Talos detailed how malicious Python packages can execute payloads during installation as well as at runtime by abusing build hooks and package contents, including `setup.py` command classes, `.pth` files, `sitecustomize` and `usercustomize` hooks, `PYTHONPATH` manipulation, import-time code in `__init__.py`, `__main__.py`, and hijacked entry points. The research cited real-world supply-chain cases including TeamPCP activity, the `litellm` compromise, VIPERTUNNEL abuse of site hooks, and the lightning compromise, while defenders were urged to harden package intake with lock files, cryptographic hashes, isolated build environments, SBOM generation, dependency cooldowns, package auditing, and PyPI Trusted Publishing via OIDC.
Jul 14, 2026