GitHub Dependabot and PyPI add time-based supply-chain defenses
Security Tool/Service
Summary
Hide ▲
Show ▼
GitHub Dependabot and PyPI added time-based controls that slow malicious package adoption and restrict late release tampering across the software supply chain. Dependabot now defaults to a 72-hour cooldown, while PyPI rejects new files for releases older than 14 days. The changes are meant to reduce exposure to newly published malicious packages and release poisoning. The rollout tightens package trust windows after a run of supply-chain attacks across both ecosystems.
Related Happenings
Malicious npm and PyPI payment SDK typosquat packages
Malware Activity
H score40
First: 09.07.2026 18:09
Last: 09.07.2026 18:09
Sources 1
About this happening:
The 17 malicious npm and PyPI packages targeted Paysafe, Skrill, and Neteller SDKs to steal system information and developer secrets, then send the data to an Ng...
Malicious npm and PyPI payment SDK typosquat packages
Malware ActivityAbout this happening: The 17 malicious npm and PyPI packages targeted Paysafe, Skrill, and Neteller SDKs to steal system information and developer secrets, then send the data to an Ng...
Rollup polyfill npm package malware activity for remote access and data theft
Malware Activity
H score16
First: 03.07.2026 19:07
Last: 03.07.2026 19:07
Sources 1
About this happening:
Malicious npm packages disguised as Rollup polyfill tooling are now delivering remote-access and data-theft payloads to developer workstations and build machines. The...
Rollup polyfill npm package malware activity for remote access and data theft
Malware ActivityAbout this happening: Malicious npm packages disguised as Rollup polyfill tooling are now delivering remote-access and data-theft payloads to developer workstations and build machines. The...
Atomic-lockfile rootkit-infostealer distribution through AUR packages
Malware Activity
H score3
First: 12.06.2026 20:03
Last: 12.06.2026 20:03
Sources 1
About this happening:
AUR packages are distributing the atomic-lockfile Linux rootkit and infostealer through compromised build scripts, with more than 400 packages reported and the o...
Atomic-lockfile rootkit-infostealer distribution through AUR packages
Malware ActivityAbout this happening: AUR packages are distributing the atomic-lockfile Linux rootkit and infostealer through compromised build scripts, with more than 400 packages reported and the o...
Npm v12 default-blocks install scripts, Git dependencies, and remote URLs
Security Tool/Service
H score11
First: 12.06.2026 16:00
Last: 12.06.2026 16:00
Sources 1
About this happening:
GitHub announced npm v12 with default-blocking install scripts, Git dependencies, and remote URLs, shifting package installation to explicit opt-in and reducing supp...
Npm v12 default-blocks install scripts, Git dependencies, and remote URLs
Security Tool/ServiceAbout this happening: GitHub announced npm v12 with default-blocking install scripts, Git dependencies, and remote URLs, shifting package installation to explicit opt-in and reducing supp...
Miasma supply-chain malware activity
Malware Activity
H score34
First: 10.06.2026 23:27
Last: 10.06.2026 23:27
Sources 1
About this happening:
The Miasma malware activity is enabling supply-chain compromise by stealing build environment and cloud credentials, then using them to poison legitimate packages...
Miasma supply-chain malware activity
Malware ActivityAbout this happening: The Miasma malware activity is enabling supply-chain compromise by stealing build environment and cloud credentials, then using them to poison legitimate packages...
Timeline
-
26.07.2026 17:13 2 articles · 2h ago
GitHub and PyPI add time-based supply-chain defenses
Mitigation Patch UpdateGitHub and PyPI introduced time-based supply-chain controls for Dependabot and package release workflows: Dependabot now defaults to a 72-hour cooldown before new package versions are adopted, and PyPI now rejects new files uploaded to releases older than 14 days. The changes are intended to slow automatic adoption of newly published malicious packages and reduce release-poisoning risk in the affected ecosystems.
Show sources
- GitHub, PyPI add time-absed defenses against supply chain attacks — www.bleepingcomputer.com — 26.07.2026 17:13
- GitHub, PyPI add time-absed defenses against supply chain attacks — www.bleepingcomputer.com — 26.07.2026 17:13