GitHub and PyPI Deploy Time‑Based Cooldowns to Thwart Supply‑Chain Package Poisoning
What Happened — GitHub’s Dependabot now enforces a default three‑day “cool‑down” before automatically opening update pull requests, and PyPI will reject any new files added to a release older than 14 days. Both measures aim to limit the window attackers have to inject malicious code into widely‑used open‑source packages.
Why It Matters for Compliance & Audit Readiness
- Demonstrates a concrete control against the supply‑chain risk vector that SOC 2 auditors expect under Change Management (CC6.1) and System Operations (CC3.1).
- Provides continuous, auditable evidence that your organization enforces a delay and validates third‑party components before they reach production.
- Aligns with Verisq’s Control Mapping capability, enabling you to capture the new cooldown settings as proof of control effectiveness in a Trust Center report.
Who Is Affected — Software development teams, DevOps groups, and any organization that consumes third‑party libraries from GitHub or PyPI (technology, finance, healthcare, etc.).
Recommended Actions
- Update internal dependency‑management policies to incorporate the three‑day Dependabot cooldown and the 14‑day PyPI release lock.
- Map these policies to SOC 2 controls (CC6.1 Change Management, CC3.1 System Operations) and begin collecting evidence of compliance (e.g., logs of cooldown configuration, blocked uploads).
- Deploy automated monitoring that flags any package updates that bypass the cooldown, and integrate findings into your continuous‑compliance dashboard.
Source: BleepingComputer
Technical Notes
- Attack vector mitigated: third‑party dependency poisoning via compromised publishing tokens or CI pipelines.
- Defensive controls: Dependabot’s configurable 72‑hour delay; PyPI’s 14‑day immutable release window.
- No specific CVE is referenced; the measures address a class of supply‑chain tactics observed in the “chalk”, “debug”, “s1ngularity”, Shai‑Hulud, and GhostAction campaigns.