New GitHub, PyPI Policies Boost Supply Chain Security

Supply chain attacks targeting open-source package repositories have become a critical vector for widespread compromise, as attackers exploit the trust developers place in third-party dependencies. GitHub's new three-day Dependabot cooldown addresses the risk of malicious packages being rapidly ingested before security checks can flag them. PyPI's 14-day upload block on older releases directly counters a known attack pattern where compromised publishing tokens are used to inject malicious code into stable, trusted versions. These policies reflect a broader industry recognition that the integrity of the software supply chain must be enforced at the platform level, not left solely to individual developers. Without such guardrails, a single compromised credential or malicious maintainer can poison thousands of downstream projects.