In brief: GitHub introduces a 72-hour delay for automated package updates, while PyPI blocks file uploads to older versions after 14 days.
GitHub and PyPI implement delay mechanisms to slow the spread of manipulated software packages. Both platforms are responding to documented supply-chain attacks such as chalk, debug and s1ngularity.
GitHub activates a default 72-hour delay in Dependabot before automated package updates. The deadline can be individually adjusted via the cooldown configuration option. The mechanism is designed to bridge the time window between publication and detection of malicious packages – while previous security tools often identified harmful npm packages within minutes, a period remained for infections until manual removal by platform operators.
The Python Package Index (PyPI) blocks the retroactive addition of new files to package releases published more than 14 days ago. This rule prevents attacks where attackers use compromised credentials to retroactively inject malicious code into older, trusted versions. According to the platform’s assessment, developers typically do not upload to existing versions after two weeks.
The two measures address different attack vectors at the same time: while GitHub’s delay targets massively published new packages, PyPI’s upload block protects against compromise of established, well-trusted releases. Both mechanisms raise the bar for time-sensitive infection waves.
GitHub additionally recommends engineers fix dependencies via lockfiles, use tokens with restricted permissions, and disable unnecessary installation scripts in CI systems. These measures reduce the attack surface independently of the platform-side delays.
Source: www.it-daily.net · Published 27 July 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.