GitHub Adds 3‑Day Cool‑down to Dependabot Version Updates to Thwart Rapid npm Supply‑Chain Malware
What Happened — In September 2025 a threat actor compromised an npm maintainer’s credentials and published malicious versions of popular packages (e.g., chalk, debug). The poisoned releases were live for roughly two hours before the community removed them. To prevent automated tools from pulling in such code, GitHub’s Dependabot now imposes a minimum three‑day wait on non‑security version bumps before opening a pull request. Security‑related updates remain immediate.
Why It Matters for Compliance & Audit Readiness
- The delay directly addresses a classic supply‑chain control gap that SOC 2’s CC6.1 – System Operations expects organizations to mitigate through change‑management and dependency‑review processes.
- Continuous evidence of the cooldown policy (e.g., dependabot.yml settings, PR timestamps) provides audit‑ready proof that you are actively managing third‑party software risk.
- Mapping this new control to your SOC 2 control matrix helps demonstrate due‑diligence and can be captured automatically for the Control Mapping capability in Verisq’s Trust Center.
Who Is Affected — SaaS developers, open‑source projects, and any organization that consumes npm packages—spanning fintech, health‑tech, and enterprise software.
Recommended Actions
- Update your dependabot.yml to enable the three‑day cooldown for version updates and document the setting in your change‑management policy.
- Integrate Dependabot PR metadata into your continuous‑compliance platform to automatically collect evidence of delayed updates.
- Conduct a quick audit of existing dependency‑update pipelines to ensure they respect the new window and that security‑only updates remain immediate.
Source: Help Net Security
Technical Notes
- Attack vector: malicious npm package publication (supply‑chain malware).
- Impact: code rewrote cryptocurrency wallet addresses in any browser app loading the compromised libraries.
- Frequency: GitHub’s Advisory Database logged > 6,500 npm malware advisories in the year ending May 2026 (~18 per day).