GitHub and PyPI Add Time-Based Defenses Against Supply-Chain Attacks
GitHub and PyPI Add Time-Based Defenses Against Supply-Chain (TL-2026-1706), also tracked as Dependabot cooldown, is a informational-severity advisory threat, first published 2026-07-26. It has no confirmed attribution, affects GitHub Dependabot version updates, references 1 CVE (CVE-2025-10894), maps to 24 MITRE ATT&CK techniques (T1005, T1020, T1027), and is covered by 9 detection rules and 27 indicators of compromise.
Key facts for TL-2026-1706
- Threat ID
- TL-2026-1706
- Also known as
- Dependabot cooldown, PyPI release-file lock, PyPI release poisoning prevention
- Severity
- INFORMATIONAL
- Status
- ACTIVE
- Category
- ADVISORY
- First published
- 2026-07-26
- Last reviewed
- 2026-07-26
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- software development, technology, open source ecosystem, cloud infrastructure, financial services cryptocurrency, artificial intelligence mlops
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in GitHub and PyPI Add Time-Based Defenses Against Supply-Chain
Malware and tooling: Shai-Hulud, trivy-action
GitHub now defaults Dependabot to a 72-hour "cooldown" before opening version-update PRs, and PyPI blocks new files from being added to a release more than 14 days after publication — both direct responses to a string of 2025-2026 supply-chain compromises (npm chalk/debug, Nx s1ngularity, Shai-Hulud, GhostAction, and the TeamPCP/Trivy-LiteLLM-Telnyx cascade).
How GitHub and PyPI Add Time-Based Defenses Against Supply-Chain works
On 2026-07-14 GitHub announced that Dependabot version updates now wait a default of three days after a new package release before opening an update pull request, giving the ecosystem time to detect and react to a malicious or broken release before it is pulled into a dependency tree; security updates are exempt and still open immediately. Eight days later, on 2026-07-22, the Python Package Index (PyPI) announced that releases can no longer accept new file uploads more than 14 days after initial publication, closing a 'release poisoning' window in which an attacker holding a stolen or long-lived publishing token could quietly add a malicious wheel/sdist to an already-trusted, widely-installed release.
Both changes are explicit, named responses to a run of high-impact open-source supply-chain compromises rather than to any single CVE: the September 2025 phishing takeover of npm maintainer 'Qix' that poisoned chalk, debug, ansi-styles and 15 other packages (2.6B weekly downloads) with a browser-based crypto-wallet drainer; the August 2025 'Nx s1ngularity' attack (CVE-2025-10894) in which a flawed GitHub Actions workflow let attackers publish trojanized Nx build-system packages that harvested credentials and later flipped thousands of victim GitHub repositories public; the self-propagating 'Shai-Hulud' npm worm (first seen September 2025, a more aggressive 'Second Coming' variant in November 2025) that stole npm/GitHub/cloud tokens and used them to automatically re-infect and republish hundreds of other maintainers' packages; the 'GhostAction' campaign (discovered September 2025 by GitGuardian) that injected credential-exfiltrating GitHub Actions workflows into 817+ repositories, stealing 3,325 secrets including PyPI, npm, Docker Hub, Cloudflare and AWS tokens; and, most directly motivating the PyPI change, the March 2026 'TeamPCP' campaign, which force-pushed 75 of 76 version tags of Aqua Security's popular trivy-action GitHub Action to malicious commits (a 'mutable git tag' abuse), used the resulting CI compromise to steal the PyPI publishing token for LiteLLM, and backdoored the litellm (1.82.7/1.82.8, ~480M downloads) and telnyx (4.87.1/4.87.2) PyPI packages with cloud-credential stealers.
Neither GitHub's nor PyPI's change addresses a specific vulnerability in a specific product; they are platform-level mitigations that raise the cost and shrink the time window for the exact TTP pattern seen across all five campaigns: compromise a maintainer credential or CI/CD token, then either publish a new malicious version quickly (countered by the Dependabot cooldown, which delays automatic adoption) or quietly append a malicious file to an already-trusted release later (countered by PyPI's 14-day upload lock). GitHub additionally recommends lockfile pinning, restricted-scope tokens, and disabling install scripts in CI as complementary controls; PyPI notes the 14-day rule is an interim measure pending the more complete PEP 694 'Upload 2.0' API.
MITRE ATT&CK techniques used in TL-2026-1706
Collection
Exfiltration
T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service
Discovery
T1083 File and Directory Discovery; T1087 Account Discovery
Persistence
T1098 Account Manipulation; T1546 Event Triggered Execution
Initial Access
T1195 Supply Chain Compromise; T1199 Trusted Relationship; T1566 Phishing
Impact
T1485 Data Destruction; T1565 Data Manipulation
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Lateral Movement
Resource Development
Affected products and versions in GitHub and PyPI Add Time-Based Defenses Against Supply-Chain
- GitHub — Dependabot version updates
Vulnerable versions: no default cooldown before 2026-07-14
Fixed in: default 72-hour cooldown, 2026-07-14 onward; expandable to GHES 3.23 - Python Software Foundation — PyPI (Python Package Index)
Vulnerable versions: releases accepted new file uploads indefinitely before 2026-07-08
Fixed in: new-file uploads to releases rejected after 14 days, enforced 2026-07-08 onward - npm / open source community — chalk, debug, ansi-styles and related packages
Vulnerable versions: chalk 5.6.1; debug 4.4.2; ansi-styles 6.2.2; color-convert 3.1.1; strip-ansi 7.1.1
Fixed in: malicious versions removed from npm, 2025-09-08 - Nrwl (Nx) — nx build system and @nx/* plugins
Vulnerable versions: nx 20.9.0-21.8.0 and related @nx/devkit, @nx/js, @nx/workspace, @nx/node, @nx/eslint, @nx/key, @nx/enterprise-cloud packages
Fixed in: malicious versions pulled from npm, 2025-08-26 - BerriAI — litellm (PyPI)
Vulnerable versions: 1.82.7; 1.82.8
Fixed in: quarantined by PyPI ~40 minutes after publish, 2026-03-24 - Telnyx — telnyx (PyPI)
Vulnerable versions: 4.87.1; 4.87.2
Fixed in: removed following discovery, 2026-03-27 - Aqua Security — trivy-action (GitHub Action)
Vulnerable versions: 75 of 76 version tags force-pushed to malicious commits, March 2026
Fixed in: pinning to commit SHA recommended over mutable tags
Remediation for GitHub and PyPI Add Time-Based Defenses Against Supply-Chain
Patches
- Upgrade GitHub Enterprise Server to 3.23+ to receive Dependabot default-cooldown support
- Confirm internal package-publishing tooling tolerates PyPI's 14-day post-publication upload lock (enforced since 2026-07-08)
Immediate actions
- Pin all GitHub Actions and CI/CD dependencies to full commit SHAs, never to mutable version tags (root cause of the TeamPCP/trivy-action compromise)
- Rotate any PyPI, npm, GitHub, Cloudflare, AWS, or Docker Hub tokens that were ever exposed to a workflow run in a repository affected by GhostAction or TeamPCP
- Search egress/proxy logs for the known malicious domains and IPs (webhook.site paste endpoint, *.plesk.page GhostAction exfil host, checkmarx.zone, models.litellm.cloud, 83.142.209.203)
- Audit recently auto-merged Dependabot version-update PRs opened before the 72-hour cooldown was enabled for anything pulled from a since-yanked malicious release
Workarounds
- Where the 72-hour default cooldown is insufficient for high-risk ecosystems, explicitly configure a longer `cooldown` window per-ecosystem in dependabot.yml
- Vendor or lockfile-pin critical dependencies pending manual review rather than relying solely on the cooldown window
Longer-term hardening
- Adopt Trusted Publishing (OIDC short-lived tokens) for PyPI and npm packages instead of long-lived API tokens
- Enable and tune Dependabot's default cooldown (or set a longer window) in .github/dependabot.yml across all repositories
- Run npm/pip installs with install-scripts disabled (--ignore-scripts) in CI where postinstall/build hooks are not required
- Require phishing-resistant MFA (WebAuthn/hardware keys) for all package-registry maintainer and CI publishing accounts
CVEs associated with GitHub and PyPI Add Time-Based Defenses Against Supply-Chain
CVE-2025-10894
Weaknesses (CWE) in GitHub and PyPI Add Time-Based Defenses Against Supply-Chain
CWE-506, CWE-829, CWE-494
Timeline of GitHub and PyPI Add Time-Based Defenses Against Supply-Chain
- Attackers exploit a flawed GitHub Actions workflow in the Nx repository to publish trojanized Nx build-system npm packages (versions 20.9.0-21.8.0 and related @nx/* plugins) carrying credential-harvesting malware (CVE-2025-10894).
- Attackers use leaked GitHub tokens from the Nx compromise to flip thousands of victims' private repositories public and rename them with the 's1ngularity' string, exposing roughly 6,700 private repositories in phase two of the s1ngularity attack.
- First signs of the GhostAction credential-exfiltration campaign are detected on the FastUUID project.
- GitGuardian discovers the full scope of the GhostAction campaign — malicious GitHub Actions workflows injected into 817+ repositories exfiltrating 3,325 secrets — and notifies GitHub, npm, and PyPI.
- npm maintainer 'Qix' is phished via a fake npm-support domain (npmjs.help); the attacker publishes crypto-wallet-draining malware into chalk, debug, ansi-styles and 15 other packages with 2.6B combined weekly downloads.
- ReversingLabs first identifies the self-propagating 'Shai-Hulud' npm worm, which steals developer/npm/cloud tokens and automatically republishes itself into other maintainers' packages.
- A more aggressive 'Shai-Hulud 2.0 / The Second Coming' variant emerges, achieving pre-install execution and expanding to over 25,000 malicious repositories across roughly 350 unique npm accounts.
- Threat actor TeamPCP force-pushes 75 of 76 version tags of Aqua Security's trivy-action GitHub Action to malicious commits (mutable-tag abuse), cloning original commit metadata to evade detection.
- A LiteLLM co-founder's GitHub account is compromised via the poisoned Trivy CI dependency; malicious commits are pushed to the litellm and litellm-skills repositories.
- Backdoored litellm packages (1.82.7, 1.82.8, ~480M downloads) are published to PyPI with a cloud-credential stealer; PyPI quarantines them roughly 40 minutes later.
- Backdoored telnyx packages (4.87.1, 4.87.2) are published to PyPI as the TeamPCP cascade spreads to a second SDK.
- PyPI merges the patch restricting new file uploads to releases older than 14 days.
- GitHub announces Dependabot version updates now default to a 72-hour cooldown before opening update pull requests, across all supported ecosystems.
- PyPI publicly announces that releases reject new file uploads after 14 days, closing the release-poisoning window exploited in spirit by the LiteLLM/Telnyx and GhostAction incidents.
- BleepingComputer reports on both the Dependabot cooldown and PyPI upload-lock defenses together as a coordinated ecosystem response to the year's supply-chain compromises.
Sources cited for GitHub and PyPI Add Time-Based Defenses Against Supply-Chain
- GitHub, PyPI add time-based defenses against supply chain attacks
- Dependabot version updates introduce default package cooldown
- Releases now reject new files after 14 days
- Incident Report: LiteLLM/Telnyx supply-chain attacks, with guidance
- CVE-2025-10894 / GHSA-cxm3-wv7p-598c: Malicious versions of Nx were published
- s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know
- AI-powered malware hit 2,180 GitHub accounts in "s1ngularity" attack
- "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack
- Hackers steal 3,325 secrets in GhostAction GitHub supply chain attack
- Widespread npm Supply Chain Attack: Breaking Down Impact & Scope Across Debug, Chalk, and Beyond
- Inside the TeamPCP cascading supply chain attack
- PyPI invalidates tokens stolen in GhostAction supply chain attack
Threats related to GitHub and PyPI Add Time-Based Defenses Against Supply-Chain
- Miasma / Shai-Hulud Supply-Chain Campaign Pushes Password-Stealing Malware via Compromised Microsoft GitHub Repos (durabletask PyPI 1.4.1-1.4.3)
- Malicious npm Package 'shai_hulululud' (v1.0.48596): Prompt Injection, AI-Safety Triggering, and Token Flooding to Evade AI Malware Scanners (Shai-Hulud Lineage)
- TeamPCP LiteLLM Supply Chain Attack — Trojaned PyPI Packages (v1.82.7/1.82.8) with Multi-Stage C2 Payload
- Shai-Hulud NPM Worm Compromises keyv, file-entry-cache, flat-cache and Hundreds of Popular npm Packages via Maintainer Account Takeover
- TeamPCP Cascading Supply Chain Campaign: Telnyx PyPI Compromise with WAV Steganography
- npm Supply-Chain Compromise (chalk/debug + 17 packages, Sept 2025) — Motivates GitHub Dependabot 'Cooldown' Mitigation
Detection coverage for TL-2026-1706
As of 2026-07-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1706 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.