[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foOKwU6S24p2z0CBc0DKefyC_FblvwKzs2RjzGaXgdx8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48,"controls":49},"ea087634-1dd0-440b-a7db-f3094e9ce4a6","github-pypi-tighten-supply-chain-defenses-with-new-policies","4cc009e9-e55b-4751-844e-85d1a39c6a4d","GitHub & PyPI Tighten Supply Chain Defenses with New Policies","Supply chain attacks targeting open-source package repositories have become a critical vector for widespread compromise, as attackers exploit the trust developers place in third-party dependencies. GitHub's new three-day Dependabot cooldown addresses the risk of malicious packages being rapidly ingested before security checks can flag them. PyPI's 14-day upload block on older releases directly counters a known attack pattern where compromised publishing tokens are used to inject malicious code into stable, trusted versions. These policies reflect a broader industry recognition that the integrity of the software supply chain must be enforced at the platform level, not left solely to individual developers. Without such guardrails, a single compromised credential or malicious maintainer can poison thousands of downstream projects.","**Immediate actions:**\n- Audit all third-party dependencies in your projects using tools like Dependabot, Snyk, or OWASP Dependency-Check.\n- Rotate and scope PyPI and GitHub publishing tokens to the minimum necessary permissions immediately.\n- Enable two-factor authentication (2FA) on all package registry and source control accounts.\n\n**Long-term improvements:**\n- Implement a software bill of materials (SBOM) process to maintain a verified inventory of all open-source components.\n- Adopt a policy of pinning dependency versions and verifying checksums\u002Fhashes in CI\u002FCD pipelines.\n- Establish an internal vetting period before adopting newly released package versions in production environments.\n\n**Detection measures:**\n- Monitor package dependency trees continuously for unexpected version changes or new transitive dependencies.\n- Set up alerts for any automated pull requests from Dependabot or similar tools to trigger a security review workflow.\n- Integrate Software Composition Analysis (SCA) scanning into every CI\u002FCD pipeline build to catch malicious or vulnerable packages early.",[12,13,14,15,16,17,18,19,20],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 16 – Application Software Security","NIST SP 800-161 – Cyber Supply Chain Risk Management","NIST SSDF (SP 800-218) – Secure Software Development Framework","NIST CSF DE.CM-3 – Personnel activity monitoring","SLSA Framework – Supply chain Levels for Software Artifacts","OpenSSF Scorecard – Open Source Security Scoring","NIST SP 800-53 SA-12 – Supply Chain Protection","ISO\u002FIEC 27036 – Information Security for Supplier Relationships",{},"published","2026-07-27T16:22:21.660131+00:00","2026-07-27T16:22:21.394+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fwww.securityweek.com\u002Fnew-github-pypi-policies-boost-supply-chain-security\u002F","new-github-pypi-policies-boost-supply-chain-security-7123e6","New GitHub, PyPI Policies Boost Supply Chain Security",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":37,"name":38,"slug":39,"description":40,"color":41},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":43,"name":44,"slug":45,"description":46,"color":47},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[50],{"slug":51,"name":52,"problem":53},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]