GitHub and PyPI Add Time-Based Defenses Against Supply Chain Attacks

Time Is Now a Security Control

Software supply chain attacks have become one of the most potent threat vectors in modern cybersecurity — from SolarWinds to XZ Utils, attackers increasingly target the dependency layer rather than applications directly. In response, GitHub and PyPI (Python Package Index) have jointly introduced time-based defenses through Dependabot, creating a new class of protection designed to limit the blast radius of compromised or malicious packages.

What Changed

The new mechanism introduces a time-based verification window for dependency updates processed through Dependabot. Rather than accepting a new package version immediately upon publication, the system enforces a waiting period before automatically applying updates.

Why Time-Based Defenses Work

Supply chain attacks often exploit the gap between a malicious package being published and defenders detecting it. A time-based window directly narrows this gap by:

• Preventing instant propagation — Dependabot PRs are not opened until the package has aged past the threshold
• Allowing community vetting — Security researchers, automated scanners, and maintainers have time to flag suspicious releases
• Blocking fast-and-exit attacks — Attackers who publish a malicious version and quickly delete it cannot exploit the dependency before it's flagged

Traditional Flow (vulnerable):
  Attacker publishes malicious v2.3.1
  → Dependabot opens PR within minutes
  → Automated merge CI deploys to prod
  → Attacker's payload executes
 
Time-Based Flow (protected):
  Attacker publishes malicious v2.3.1
  → Dependabot holds update for N hours/days
  → Security scanners flag suspicious release
  → Alert raised before PR is ever opened
  → Dependency never enters the supply chain

Attack Types This Mitigates

PyPI's Parallel Effort

PyPI independently introduced publish-time verification windows that require new package versions to pass a brief automated review before becoming available for automatic ingestion by tools like pip and Dependabot. This includes:

• Malware scanning on upload using multiple detection engines
• Automated typosquatting detection against the top-downloaded package corpus
• Provenance attestation verification for packages using Trusted Publishing

# PyPI Trusted Publishing — enforced on new packages
# Packages without provenance attestation face longer review windows
pip install somepackage --require-hashes

Configuring Dependabot Time-Based Controls

GitHub's new Dependabot configuration options allow teams to tune the time window per ecosystem:

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "weekly"
    # New: minimum package age before Dependabot opens a PR
    minimum-package-age: "7 days"
    open-pull-requests-limit: 10
    ignore:
      # Ignore pre-release versions entirely
      - dependency-name: "*"
        update-types: ["version-update:semver-pre-release"]

Recommendations for Security Teams

1. Enable time-based Dependabot controls — Set minimum-package-age to at least 72 hours for production dependencies
2. Use hash pinning — Pin exact hashes in requirements.txt to prevent silent version substitution
3. Enforce Trusted Publishing — For packages you maintain, use PyPI Trusted Publishing to provide provenance attestation
4. Monitor new dependency PRs — Review Dependabot PRs critically; don't auto-merge without human review
5. Subscribe to PyPI security advisories — Follow PyPI's security feed for your critical dependencies
6. Audit transitive dependencies — Use pip-audit or safety to scan the full dependency tree

# Audit Python dependencies for known vulnerabilities
pip install pip-audit
pip-audit --require-hashes -r requirements.txt
 
# Check for typosquatted packages
pip install typogard
typogard check requirements.txt

Industry Context

This move by GitHub and PyPI follows a string of high-profile supply chain incidents:

The addition of time-based controls represents a shift from purely reactive (CVE detection post-publish) to proactive temporal controls — a meaningful architectural improvement for the open-source ecosystem.

Sources

• BleepingComputer — GitHub, PyPI add time-based defenses against supply chain attacks
• PyPI Blog — Security improvements for package publishing
• GitHub Security Blog — Dependabot supply chain hardening

Related Reading

• Trivy Security Scanner GitHub Actions Breached — 75 Tags Hijacked
• Glassworm Supply Chain Attack Abuses 72 Open VSX Extensions