GitHub and PyPI implement new security measures against supply-chain attacks

Based on information from Bleeping Computer, GitHub and the Python Package Index (PyPI) have introduced new time-based security mechanisms within their development tools to combat supply-chain attacks and mitigate their potential impact.

GitHub's Dependabot, a tool that automates dependency updates, now includes a default three-day cooldown period. This delay is intended to prevent the automatic adoption of newly published malicious packages, as attackers have previously exploited the window between a malicious package's publication and its removal. While this period can be configured, it aims to balance security with the need for timely updates. Concurrently, PyPI has implemented a policy rejecting new files uploaded to package releases older than 14 days. This measure is designed to prevent attackers who gain access to publishing tokens or workflows from compromising older, trusted releases. Although no confirmed attacks on PyPI have utilized this specific release poisoning technique, the platform is proactively blocking this potential threat vector. These changes follow a series of high-profile supply-chain attacks impacting both ecosystems over the past year, including incidents involving popular packages like 'chalk' and 'debug'.

Source: Bleeping Computer