[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhVv3zo7mFztrjW445NpWH4QzytGgmh4XTNbxewdShAA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":20,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":41,"controls":42},"eb9c2cdd-bc86-4f0e-9735-45d33bfe87c3","githubs-dependabot-cooldown-tackles-poisoned-package-risk","57f6c08c-6a91-4285-b508-981d26154c58","GitHub's Dependabot Cooldown Tackles Poisoned Package Risk","Supply chain attacks increasingly exploit automated dependency update tools like Dependabot, which can rapidly pull malicious package versions into production codebases before the threat is detected and removed. Threat actors deliberately publish poisoned packages, knowing that automation will propagate them widely within hours. GitHub's three-day cooldown for non-security updates creates a critical observation window, allowing the community and security tooling to flag malicious releases before they are widely adopted. This incident highlights how convenience features in the software supply chain can become attack vectors if not governed with appropriate safeguards. Organizations that blindly trust automated dependency updates without review policies face significant risk of introducing compromised code.","**Immediate actions:**\n- Enable GitHub's three-day Dependabot cooldown for all repositories handling version (non-security) updates.\n- Audit current Dependabot configurations to ensure security updates remain expedited while version updates are subject to review delays.\n- Subscribe to security advisories for all key dependencies to receive early warnings about poisoned or malicious packages.\n\n**Long-term improvements:**\n- Implement a Software Composition Analysis (SCA) tool in your CI\u002FCD pipeline to automatically scan every dependency update for known vulnerabilities and suspicious changes.\n- Establish a formal dependency review policy requiring human approval or automated integrity checks before merging automated dependency PRs.\n- Maintain a curated internal package registry or mirror to control which package versions are permitted in production builds.\n\n**Detection measures:**\n- Monitor dependency update pull requests for unexpected behavioral changes, new permissions, or unusual code patterns introduced by package upgrades.\n- Integrate threat intelligence feeds that track newly reported malicious packages across registries such as npm, PyPI, and RubyGems.\n- Set up alerting for any dependency that is updated and then quickly deprecated or yanked by its publisher, which may indicate a poisoned release.",[12,13,14,15,16,17,18,19],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161r1: Supply Chain Risk Management Practices","NIST SSDF PW.4: Reuse Existing, Well-Secured Software","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","SLSA Supply Chain Levels for Software Artifacts (SLSA) Framework","OWASP A06:2021 – Vulnerable and Outdated Components",{},"published","2026-07-27T10:20:59.465135+00:00","2026-07-27T10:20:59.341+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fgithub-adds-3-day-dependabot-cooldown.html","github-adds-3-day-dependabot-cooldown-to-limit-poisoned-package-adoption-c2fbf6","GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption",[29,35],{"id":30,"name":31,"slug":32,"description":33,"color":34},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":36,"name":37,"slug":38,"description":39,"color":40},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[43,46],{"slug":32,"name":44,"problem":45},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":47,"name":48,"problem":49},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]