# GitHub and PyPI Time-Based Defenses Against Supply Chain Attacks > GitHub and PyPI introduce time-based delays in Dependabot to mitigate supply chain attacks by preventing the immediate ingestion of malicious packages. - Published: 2026-07-26T17:03:02.000Z - Severity: info - Category: Supply Chain - Tags: GitHub, PyPI, Dependabot, Supply Chain Security, Python - Author: Runtime Rebel Intel - Primary source: https://www.bleepingcomputer.com/news/security/github-pypi-add-time-absed-defenses-against-supply-chain-attacks/ - Canonical: https://runtimerebel.com/blog/github-and-pypi-time-based-defenses-against-supply-chain-attacks ## Key points - Development teams face heightened risks from malicious packages that are automatically ingested by dependency management tools immediately after publication to public repositories. - The new security feature affects GitHub repositories using Dependabot to manage Python dependencies sourced from the Python Package Index. - Defenders should implement a wait period in their Dependabot configuration to delay updates until new package versions have been vetted by the community. GitHub and the Python Package Index (PyPI) have implemented a strategic defensive mechanism designed to counter the rapid proliferation of malicious software within the open-source ecosystem. According to [BleepingComputer](https://www.bleepingcomputer.com/news/security/github-pypi-add-time-absed-defenses-against-supply-chain-attacks/), these organizations have introduced time-based delays for automated dependency updates. This feature allows developers to specify a "cool-off" period before Dependabot suggests or applies an update to a newly released package version, effectively shrinking the window of opportunity for a [Supply Chain Attack](/glossary#supply-chain-attack). ## Enhancing Supply Chain Security via Temporal Delays The primary threat addressed by this update is the speed at which automated tools operate. In contemporary DevOps environments, a new package version published to a public repository is often picked up by automated systems within minutes. If an attacker successfully executes a "dependency confusion" attack or compromises a maintainer's account to release a malicious version, organizations that rely on instantaneous updates are compromised before the security community has time to identify and report the threat. By introducing a time-based delay, GitHub and PyPI are creating a buffer. Historical data suggests that many malicious packages are identified and removed from public registries within 24 to 48 hours of publication. A mandatory or elective delay ensures that developers only receive update notifications for versions that have survived this initial period of scrutiny. This is a significant shift in defensive [TTP](/glossary#ttp) strategy, moving away from purely reactive scanning toward proactive risk containment. ### GitHub Dependabot Time-Based Security Configuration To leverage this protection, developers must adjust their repository settings. The **GitHub Dependabot time-based security configuration** is managed through the `dependabot.yml` file. Within this configuration, users can define a `wait-period` for specific ecosystems. For the initial rollout, PyPI is the primary supported registry, providing the necessary metadata to help Dependabot determine the precise age of a package version. This configuration allows teams to balance their need for the latest features and security patches against the risk of ingesting a [Zero-Day](/glossary#zero-day) malicious update. For example, a team might set a 3-day wait period for production-critical dependencies while maintaining a shorter window for internal development tools. This granular control is essential for modern [SOC](/glossary#soc) teams looking to reduce the noise and risk associated with high-frequency automated updates. ### Preventing Malicious PyPI Package Ingestion The collaboration with PyPI is critical because it relies on the registry's ability to provide trusted timestamps for every release. When a developer is focused on **preventing malicious PyPI package ingestion**, they are often fighting against typosquatting—where an attacker registers a name similar to a popular library—or account takeovers. When a wait period is active, if PyPI identifies a package as malicious and removes it during the defined window, Dependabot will never alert the user to the update. This eliminates the risk of a developer accidentally merging a [Malware](/glossary#malware) update during their morning routine. This mechanism serves as an important layer of defense that complements other security measures like [EDR](/glossary#edr) and static analysis, providing a temporal filter that automated scanners might otherwise bypass. ## Defensive Recommendations for Development Teams To maximize the effectiveness of these new tools, organizations should review their current dependency management policies. While staying updated is a core tenet of vulnerability management, the risk of a [Supply Chain Attack](/glossary#supply-chain-attack) necessitates a more nuanced approach. We recommend the following actions: * **Audit Dependabot Configurations**: Ensure that all repositories are using the latest `dependabot.yml` schema and evaluate the appropriate `wait-period` for your specific risk profile. * **Prioritize Critical Ecosystems**: Start with PyPI and Python-based workflows, as these are the first to support the full metadata requirements for time-based defenses. * **Monitor Registry Advisories**: Even with delays, teams should continue to monitor security advisories for any [CVE](/glossary#cve) that might impact their pinned dependency versions during the wait period. **Related:** [Backdoored PyTorch Lightning Package Drops Credential Stealer](/blog/backdoored-pytorch-lightning-package-drops-credential-stealer), [PyPI Supply Chain Threat: Deceptive Packages Target Developers](/blog/pypi-supply-chain-threat-deceptive-packages-target-developers) --- AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/github-and-pypi-time-based-defenses-against-supply-chain-attacks