GitHub adds 3-day Dependabot cooldown to block malicious package updates

Key Takeaways

• GitHub has implemented a mandatory three-day cooldown for Dependabot version updates.
• This delay aims to prevent automated systems from quickly adopting newly published malicious packages.
• The change specifically targets supply chain attacks where compromised accounts publish poisoned updates.
• Security updates for known vulnerabilities will still be issued immediately.
• Organizations can customize the cooldown period to suit their risk profile.

GitHub has introduced a significant change to its Dependabot service, instituting a default three-day waiting period for routine version updates. This strategic modification is designed to fortify software supply chain security by creating a buffer against the rapid propagation of malicious packages.

Addressing a Critical Supply Chain Vulnerability

The new cooldown period directly addresses a prevalent attack vector in the software supply chain: the swift distribution of compromised packages. Attackers frequently exploit compromised maintainer accounts to publish tainted updates, relying on automated dependency management tools to disseminate these malicious versions before they can be identified and removed.

A notable incident in September 2025 underscored this risk. Attackers successfully phished an npm maintainer, subsequently publishing trojanized versions of widely used packages, including “chalk” and “debug.” These packages collectively garnered over 222 billion weekly downloads. The malicious code was designed to hijack cryptocurrency payments by replacing legitimate wallet addresses in browser-based applications with attacker-controlled ones.

Although npm acted quickly, removing the malicious releases within approximately two hours, this brief window proved sufficient for automated update systems to detect the new versions and generate pull requests in downstream repositories. Development teams that merged these pull requests without thorough review risked inadvertently integrating the malicious dependency into their applications.

How Dependabot Cooldown Works

Dependabot, GitHub’s integrated dependency management solution, performs two distinct functions: security updates and version updates. Dependabot security updates are critical, automatically creating pull requests for patched versions when known vulnerabilities are disclosed. In contrast, Dependabot version updates simply refresh packages when new releases become available, even if no security flaw is present.

Crucially, the new three-day delay applies exclusively to standard Dependabot version updates. Dependabot security updates will continue to be issued immediately, as any delay in patching a publicly disclosed vulnerability could leave projects exposed to active threats.

GitHub emphasized that this cooldown period provides essential time for package maintainers, security researchers, registry operators, and automated scanning systems to detect and remove malicious releases before development teams adopt them. The protection is enabled by default, though repository maintainers retain the flexibility to adjust the delay via the cooldown configuration within their dependabot.yml file. This approach is informed by observations that malicious package releases are often identified rapidly.

The company cited several incidents, including compromised versions of “axios,” “@solana/web3.js,” “ua-parser-js,” and “Ledger Connect Kit,” where poisoned packages were typically detected within hours of their publication.

The escalating threat of npm malware further highlights the necessity of such measures. GitHub’s Advisory Database recorded over 6,500 npm malware advisories in the year ending May 2026, a slight increase from approximately 6,200 in the preceding year. This translates to an average of about 18 malicious npm packages cataloged daily.

The three-day waiting period is strategically designed to mitigate the immediate, high-risk window following package publication, while still ensuring dependencies remain reasonably current. Organizations with varying risk appetites can configure shorter or longer delays, even establishing distinct policies for internal packages versus public registries.

GitHub cautioned that cooldowns are not a standalone, comprehensive solution for supply chain security. They may not prevent long-term backdoors, malicious actions by trusted maintainers, or compromises of build and release infrastructure.

This new default setting introduces an additional layer of defense against rapid package-based attacks, discouraging developers from automatically trusting every newly published version.

What You Should Do

• Implement Lockfiles: Always use package lockfiles (e.g., package-lock.json, yarn.lock) to ensure consistent dependency versions across environments.
• Review Pull Requests: Conduct thorough, manual reviews of pull requests that introduce or update dependencies, looking for unexpected changes or suspicious code.
• Restrict CI/CD Tokens: Limit the scope and permissions of tokens used in Continuous Integration/Continuous Deployment pipelines.
• Disable Install Scripts: Where feasible, disable dependency install scripts to prevent arbitrary code execution during package installation.
• Configure Dependabot: Customize Dependabot’s cooldown period via dependabot.yml to align with your organization’s specific risk tolerance and update cadence.
• Stay Informed: Monitor security advisories and maintain awareness of common supply chain attack techniques.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.