Loading story…
Organizations are adopting dependency cooldowns to prevent build systems from automatically selecting newly published package versions during a defined waiting period. Semgrep deployed a one-week cooldown across Python projects using uv, causing resolution to choose older eligible releases while registries and the community have time to identify and remove malicious packages. Its rollout required an updated uv version, exemptions for internal or urgently needed packages and registries without reliable publication timestamps, and lockfile validation.
The control addresses supply-chain campaigns in which compromised maintainer credentials and trusted release pipelines distribute malicious updates, including reported Shai-Hulud-related npm activity. Renovate provides a comparable minimumReleaseAge policy for dependency-update workflows; updates remain pending until they meet the age threshold, while security updates bypass the delay. Effective deployment depends on strict handling of missing release timestamps, immutable dependency pinning, curated registries, short-lived OIDC credentials, restricted CI/CD runner egress, and hardened GitHub Actions workflows so a compromised update or pull request cannot seize build credentials.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
On August 4, 2026, the ChainDrop variant allegedly compromised more than 400 packages within four hours through a legitimate signed release pipeline. The poisoned packages received valid SLSA provenance because the campaign abused a compromised authorized maintainer account rather than forging signatures.
By spring 2026, the Mini Shai-Hulud variant had emerged and was targeting credentials associated with Claude, Codex, Cursor, and Gemini.
Shai-Hulud 2.0 allegedly appeared on November 24, 2025, backdooring 796 packages and executing earlier in the installation process. The variant reportedly deleted a user's home directory when it could not obtain credentials or propagate.
Between September 14 and 18, 2025, the Shai-Hulud worm allegedly altered more than 500 npm package versions. It injected a malicious postinstall payload, harvested developer and cloud credentials, and used stolen npm tokens to republish compromised maintainers' packages.
During a migration from Poetry to uv, an incorrect service entry point caused a read-only Kubernetes service to reinstall dependencies at startup and crash when installation failed. Semgrep corrected the entry point to use the image-build virtual environment and added CI testing for the failure mode.
Semgrep began rolling out dependency cooldowns in late March, using uv configuration to prevent recently published package versions from being selected automatically. The rollout used targeted exclusions for internal packages and registries lacking upload timestamps, plus automated lockfile regeneration and validation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
6 references tracked. Mallory keeps watching after this page renders.
thenewstack.io
Open sourcesemgrep.dev
Open sourceblog.yossarian.net
Open sourcedocs.renovatebot.com
Open sourcecooldowns.dev
Open sourcesecuritylab.github.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Package ecosystem maintainers and security vendors highlighted new guardrails and failure modes in automated dependency workflows. npm CLI 11.x introduced **`minimumReleaseAge`**, a release “cooldown” control that blocks installation of newly published versions until they reach a configured age, aiming to reduce exposure to malicious packages that rely on rapid adoption before detection or takedown. npm also added bulk configuration for **OIDC trusted publishing**, aligning with broader efforts to harden CI-based publishing; similar release-age gating has already been implemented in other Node.js package managers (pnpm, Yarn, and Bun), though npm’s initial implementation lacks an exclusion mechanism for cases like urgent internal hotfixes. Separately, StepSecurity reported detecting a “release storm” affecting multiple Microsoft **`@types/*`** packages on npm, where dozens of semver releases were published within 24 hours with no code changes beyond repeated deprecation-version bumps—attributed to an automation loop tied to a scheduled GitHub Actions workflow in *microsoft/DefinitelyTyped-tools* (`publish-packages.yml`). In the Go ecosystem, a maintainer of widely used cryptography code criticized GitHub **Dependabot** for generating large volumes of low-signal alerts and PRs after a minor security fix, arguing the tool often flags repositories based on dependency presence rather than reachability/actual impact, creating alert fatigue and potentially reducing security; he recommended reachability-aware tooling such as *govulncheck* for Go vulnerability triage.
Jun 29, 2026
GitHub has changed Dependabot to wait three days before opening pull requests for non-security version updates, aiming to keep fast-moving malicious package releases out of automated developer workflows. The company said the change was driven by repeated software supply-chain incidents in which poisoned npm releases were detected and removed within hours, but still had enough time to be pulled into builds. GitHub pointed to a 2025 npm compromise in which an attacker phished a maintainer and published malicious versions of widely used packages including **`chalk`** and **`debug`**, with code that rewrote cryptocurrency wallet addresses before the packages were taken down roughly two hours later. Security updates tied to known advisories are not delayed and will still be issued immediately. The move aligns with broader industry guidance that the first hours after a package is published are the highest-risk period for dependency consumers. Research cited similar attacks affecting 18 npm packages with more than 2.6 billion weekly downloads and the **Nx** build attack, which remained live for about four hours, reinforcing recommendations to delay automated updates by 24 to 48 hours or longer. GitHub said the npm ecosystem logged more than 6,500 malware advisories in the year ending May 2026 and urged teams to combine cooldowns with other controls, including lockfiles, careful review before merge, scoped CI tokens, disabling install scripts where possible, and pinning dependency versions to reduce supply-chain exposure.
Jul 29, 2026
RubyGems has introduced an opt-in **cooldown** feature in **RubyGems 4.0.13** and **Bundler 4.0.13** that delays installation of newly published gem versions to reduce exposure to malicious releases. The control lets developers require a gem version to be public for a configurable number of days before Bundler will resolve it, using per-version `created_at` timestamps from RubyGems.org’s v2 compact index. The feature is disabled by default, can be bypassed with: ```bash bundle install --cooldown 0 ``` The release comes as software supply-chain defenders respond to fast-moving package compromises, including a backdoored **`@cap-js/openapi` 1.4.1** package on npm. Guidance for affected environments says any host with that version in its dependency graph should be treated as untrusted, upgraded to **1.4.2 or later**, and followed by recycling developer sessions, execution nodes, and CI/CD containers, plus rotating exposed secrets such as AWS keys, GitHub tokens, database credentials, and npm tokens. RubyGems said the cooldown mechanism complements broader ecosystem protections including mandatory 2FA, trusted publishing, compromised-password checks, push-time validation, and AI-assisted vulnerability scanning.
Jun 29, 2026