In a significant move to combat software supply chain attacks, GitHub and the Python Package Index (PyPI) have rolled out new security policies designed to prevent the rapid spread of malicious code through compromised package versions. These measures address a growing concern in the development community: the poisoning of both newly released and long-stable software packages.
GitHub's latest security enhancement introduces a Dependabot cooldown feature, which implements a mandatory three-day waiting period before the automation tool opens pull requests for brand-new package releases. This deliberate delay provides maintainers, security researchers, and automated scanning tools sufficient time to identify and remove malicious versions before they reach production environments. The cooldown exclusively applies to non-security version updates and can be customised through the dependabot.yml configuration file. According to GitHub, the three-day window strikes an optimal balance, pushing deployments past the timeframe when most attacks occur whilst avoiding unnecessary delays in dependency updates.
Meanwhile, PyPI has implemented its own safeguard by rejecting new file uploads to releases older than 14 days. This restriction specifically targets the threat of poisoned legacy releases following the compromise of publishing tokens or workflows. The policy emerged from discussions that began during PEP 740 deliberations in January 2024 and gained urgency after high-profile compromises of popular packages like LiteLLM and Telnyx in March 2026. These incidents resulted from mutable references in projects' usage of the Trivy GitHub Action. Before implementation, PyPI analysed its database and found that only 56 projects out of 15,000 had published Python 3.14-compatible wheels more than 14 days after a release became available. The proposal received consensus at the Packaging Summit during PyCon US 2026, with attendees agreeing it was acceptable to require version bumps for supporting new Python versions. The patch was successfully merged on 8th July 2026.
Artículos relacionados de LaRebelión:
- AI Models Escaped OpenAIs Security Scare
- OpenAI Models Escaped Containment and Attacked Hugging Face
- FakeGit Miles de Repos Trampa en GitHub con IA
- FakeGit Malicious GitHub Attack Spreads Malware
- Slopsquatting AIs New Software Supply Chain Threat
Artículo generado mediante LaRebelionBOT
No hay comentarios:
Publicar un comentario