[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUnEMCgS4_ekWeQzr3BzICqnqSy7x-oU8j2HVep-dyoI":3},{"article":4,"iocs":42,"watch_terms":43,"solutions":44,"lesson":79},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"4cc009e9-e55b-4751-844e-85d1a39c6a4d","New GitHub, PyPI Policies Boost Supply Chain Security","new-github-pypi-policies-boost-supply-chain-security-7123e6","Dependabot gets a three-day cooldown window before opening pull requests, and PyPI rejects file uploads to releases older than 14 days. The post New GitHub, PyPI Policies Boost Supply Chain Security appeared first on SecurityWeek.","GitHub and PyPI have introduced new policies to bolster supply chain security. GitHub's Dependabot will now have a three-day cooldown period before opening pull requests for new releases, allowing time for security checks. PyPI is preventing the poisoning of older releases by blocking file uploads to releases older than 14 days, safeguarding against compromised publishing tokens.","GitHub and PyPI implement new policies to enhance supply chain security.","https:\u002F\u002Fwww.securityweek.com\u002Fnew-github-pypi-policies-boost-supply-chain-security\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F12\u002Fblockchain-cryptocurrency-Solana.jpeg","2026-07-27T14:26:00+00:00","2026-07-27T16:00:17.163722+00:00",7,[17,20,22],{"name":18,"type":19},"Dependabot","product",{"name":21,"type":19},"Python Package Index",{"name":23,"type":24},"open-source","technology","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":25,"icon":27,"name":28,"slug":29},null,"Supply Chain","supply-chain",[31,33,37],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":23},"ade75414-7914-4e23-a450-48b64546ee70","Open Source",{"category":38},{"id":39,"icon":27,"name":40,"slug":41},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18,21],{"controls":45,"vendors":75},[46],{"slug":47,"name":48,"problem":49,"products":50},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[51,59,67],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[76],{"slug":60,"name":61,"logo_path":62,"roles":77},[78],"reported_by",{"slug":80,"title":81,"body":82,"framework_refs":83,"framework_notes":93},"github-pypi-tighten-supply-chain-defenses-with-new-policies","GitHub & PyPI Tighten Supply Chain Defenses with New Policies","Supply chain attacks targeting open-source package repositories have become a critical vector for widespread compromise, as attackers exploit the trust developers place in third-party dependencies. GitHub's new three-day Dependabot cooldown addresses the risk of malicious packages being rapidly ingested before security checks can flag them. PyPI's 14-day upload block on older releases directly counters a known attack pattern where compromised publishing tokens are used to inject malicious code into stable, trusted versions. These policies reflect a broader industry recognition that the integrity of the software supply chain must be enforced at the platform level, not left solely to individual developers. Without such guardrails, a single compromised credential or malicious maintainer can poison thousands of downstream projects.",[84,85,86,87,88,89,90,91,92],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 16 – Application Software Security","NIST SP 800-161 – Cyber Supply Chain Risk Management","NIST SSDF (SP 800-218) – Secure Software Development Framework","NIST CSF DE.CM-3 – Personnel activity monitoring","SLSA Framework – Supply chain Levels for Software Artifacts","OpenSSF Scorecard – Open Source Security Scoring","NIST SP 800-53 SA-12 – Supply Chain Protection","ISO\u002FIEC 27036 – Information Security for Supplier Relationships",{}]