GitHub, PyPI add time-absed defenses against supply chain attacks

GitHub and PyPI (Python Package Index) have introduced a time-based mechanism in the Dependabot dependency management tool to protect against supply-chain attacks and to limit their impact.

Specifically, Dependabot comes with a default three-day cooldown setting, while PyPI will reject new files uploaded to releases older than 14 days.

The measure comes after the two development ecosystems experienced multiple high-profile attacks over the past year. Some notable examples include the ‘chalk’ and ‘debug’ attacks, the “s1ngularity” operation, the Shai-Hulud campaign, and the GhostAction supply-chain attack.

GitHub announced last month changes to tackle supply chain threats, and the hardening process progresses with the new measures.

GitHub adds Dependabot cooldown

Dependabot is GitHub’s dependency-update service that reads files containing information about new package versions and opens update pull requests to notify software maintainers.

The tool now delays the package update process for 72 hours to reduce the risk of automatically adopting newly published malicious packages.

In many recent cases, malicious npm packages were detected and flagged by security tools within minutes of being published.

However, quick detection alone does not remove the threat, as repository maintainers and vendors must still take action to remove the packages, leaving a window during which developers and projects may download and incorporate the malicious code.

While GitHub explained that the period of three days was chosen as a balanced point between avoiding risky releases while keeping up with the latest upgrades, it noted that users still have the option to configure a shorter or longer delay through Dependabot’s ‘cooldown’ configuration option.

GitHub highlighted Dependabot’s cooldown limitations against longer-term compromise, recommending the use of lockfiles for dependency pinning, restricted-scope tokens, and disabling unnecessary installation scripts in CI.

PyPI blocks release poisoning with 14-day cutoff

PyPI announced that it now blocks maintainers from adding new files to a package release after 14 days have passed since its publication.

The measure is intended to prevent attackers who compromise publishing tokens or workflows from poisoning old, trusted releases.

The platform found that only a very small percentage of projects legitimately uploaded more than two weeks after publishing a release.

It should be noted that no known past attacks on PyPI have been confirmed to use the said release poisoning technique that this new measure blocks, but the platform is acting preventatively in this case to block a dangerous possibility.