# GitHub and PyPI Add Time-Based Defenses Against Supply-Chain Attacks

> GitHub now defaults Dependabot to a 72-hour "cooldown" before opening version-update PRs, and PyPI blocks new files from being added to a release more than 14 days after publication — both direct responses to a string of 2025-2026 supply-chain compromises (npm chalk/debug, Nx s1ngularity, Shai-Hulud, GhostAction, and the TeamPCP/Trivy-LiteLLM-Telnyx cascade).

- **Published:** 2026-07-26T00:00:00Z
- **Last reviewed:** 2026-07-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1706
- **ID:** TL-2026-1706
- **Severity:** INFORMATIONAL
- **Category:** ADVISORY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-10894

## Description

On 2026-07-14 GitHub announced that Dependabot version updates now wait a default of three days after a new package release before opening an update pull request, giving the ecosystem time to detect and react to a malicious or broken release before it is pulled into a dependency tree; security updates are exempt and still open immediately. Eight days later, on 2026-07-22, the Python Package Index (PyPI) announced that releases can no longer accept new file uploads more than 14 days after initial publication, closing a 'release poisoning' window in which an attacker holding a stolen or long-lived publishing token could quietly add a malicious wheel/sdist to an already-trusted, widely-installed release.

Both changes are explicit, named responses to a run of high-impact open-source supply-chain compromises rather than to any single CVE: the September 2025 phishing takeover of npm maintainer 'Qix' that poisoned chalk, debug, ansi-styles and 15 other packages (2.6B weekly downloads) with a browser-based crypto-wallet drainer; the August 2025 'Nx s1ngularity' attack (CVE-2025-10894) in which a flawed GitHub Actions workflow let attackers publish trojanized Nx build-system packages that harvested credentials and later flipped thousands of victim GitHub repositories public; the self-propagating 'Shai-Hulud' npm worm (first seen September 2025, a more aggressive 'Second Coming' variant in November 2025) that stole npm/GitHub/cloud tokens and used them to automatically re-infect and republish hundreds of other maintainers' packages; the 'GhostAction' campaign (discovered September 2025 by GitGuardian) that injected credential-exfiltrating GitHub Actions workflows into 817+ repositories, stealing 3,325 secrets including PyPI, npm, Docker Hub, Cloudflare and AWS tokens; and, most directly motivating the PyPI change, the March 2026 'TeamPCP' campaign, which force-pushed 75 of 76 version tags of Aqua Security's popular trivy-action GitHub Action to malicious commits (a 'mutable git tag' abuse), used the resulting CI compromise to steal the PyPI publishing token for LiteLLM, and backdoored the litellm (1.82.7/1.82.8, ~480M downloads) and telnyx (4.87.1/4.87.2) PyPI packages with cloud-credential stealers.

Neither GitHub's nor PyPI's change addresses a specific vulnerability in a specific product; they are platform-level mitigations that raise the cost and shrink the time window for the exact TTP pattern seen across all five campaigns: compromise a maintainer credential or CI/CD token, then either publish a new malicious version quickly (countered by the Dependabot cooldown, which delays automatic adoption) or quietly append a malicious file to an already-trusted release later (countered by PyPI's 14-day upload lock). GitHub additionally recommends lockfile pinning, restricted-scope tokens, and disabling install scripts in CI as complementary controls; PyPI notes the 14-day rule is an interim measure pending the more complete PEP 694 'Upload 2.0' API.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1195 Supply Chain Compromise
- T1566 Phishing
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1546 Event Triggered Execution
- T1098 Account Manipulation
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1555 Credentials from Password Stores
- T1083 File and Directory Discovery
- T1087 Account Discovery
- T1005 Data from Local System
- T1570 Lateral Tool Transfer
- T1071 Application Layer Protocol
- T1102 Web Service
- T1567 Exfiltration Over Web Service
- T1020 Automated Exfiltration
- T1485 Data Destruction
- T1565 Data Manipulation

## Sources

- [GitHub, PyPI add time-based defenses against supply chain attacks](https://www.bleepingcomputer.com/news/security/github-pypi-add-time-absed-defenses-against-supply-chain-attacks/)
- [Dependabot version updates introduce default package cooldown](https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/)
- [Releases now reject new files after 14 days](https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days/)
- [Incident Report: LiteLLM/Telnyx supply-chain attacks, with guidance](https://blog.pypi.org/posts/2026-04-02-incident-report-litellm-telnyx-supply-chain-attack/)
- [CVE-2025-10894 / GHSA-cxm3-wv7p-598c: Malicious versions of Nx were published](https://github.com/advisories/GHSA-cxm3-wv7p-598c)
- [s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know](https://www.wiz.io/blog/s1ngularity-supply-chain-attack)
- [AI-powered malware hit 2,180 GitHub accounts in "s1ngularity" attack](https://www.bleepingcomputer.com/news/security/ai-powered-malware-hit-2-180-github-accounts-in-s1ngularity-attack/)
- ["Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack](https://unit42.paloaltonetworks.com/npm-supply-chain-attack/)
- [Hackers steal 3,325 secrets in GhostAction GitHub supply chain attack](https://www.bleepingcomputer.com/news/security/hackers-steal-3-325-secrets-in-ghostaction-github-supply-chain-attack/)
- [Widespread npm Supply Chain Attack: Breaking Down Impact & Scope Across Debug, Chalk, and Beyond](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-breaking-down-impact-scope-across-debug-chalk)
- [Inside the TeamPCP cascading supply chain attack](https://www.reversinglabs.com/blog/teampcp-supply-chain-attack-spreads)
- [PyPI invalidates tokens stolen in GhostAction supply chain attack](https://www.bleepingcomputer.com/news/security/pypi-invalidates-tokens-stolen-in-ghostaction-supply-chain-attack/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1706