GitHub introduces a three-day cooldown period for Dependabot updates, targeting a supply chain attack pattern where malicious code infiltrates freshly released packages This article explores packages compromised nearly. . The change follows a September 2025 npm compromise that saw an attacker phish credentials and publish trojanized versions of chalk, debug, and over a dozen other packages, downloaded more than twice billion times weekly.
GitHub cites incident data and its Advisory Database as evidence of malicious versions being pulled within hours of publication for Solana web3.js, Axios, and ua-parser-js, among others, reinforcing a broader review of 21 supply chain incidents between 2018 and 2026 that found similar packages being compromised in nearly every case.
Security teams are advised to treat the cooldown as one layer among several, alongside other security measures such as lockfile pinning, disabling install scripts in CI environments, scoping build pipeline tokens, and manually reviewing dependency updates before merging changes.
