GitHub and PyPI are implementing new measures to better protect software developers against attacks via the software supply chain. Both platforms are adopting a striking strategy: time. By not making updates immediately available or by blocking changes to older releases, they aim to prevent malicious code from spreading rapidly through popular software packages.
The measures follow a series of incidents in which attackers exploited open-source packages to inject malware or backdoors into developers’ systems. Attacks involving, among others, the npm packages chalk and debug, the s1ngularity operation, the Shai-Hulud campaign, and GhostAction highlighted just how vulnerable the ecosystem can be, according to BleepingComputer.
To address this, GitHub is updating its dependency manager, Dependabot. This service automatically checks whether projects are using outdated software libraries. Dependabot then creates a pull request to install a newer version.
A new feature is that Dependabot now waits 72 hours by default before suggesting a newly released package version. According to GitHub, this cooling-off period is long enough to give security researchers and package maintainers time to detect potentially malicious packages and remove them from distribution. As a result, developers do not fall far behind on new releases.
‘Waiting period’ reduces risks
In several recent attacks, malicious code was discovered within just a few minutes of publication. Yet there was often still a period afterward during which projects could download the compromised packages. This is because removal and warnings take time. The new waiting period reduces that risk.
Organizations that want to update more quickly or, conversely, more cautiously, can adjust the waiting period themselves. GitHub also emphasizes that this measure is just one part of a broader security strategy. Among other things, the company advises developers to lock down dependencies using lockfiles, use tokens with restricted permissions, and disable unnecessary installation scripts in CI environments.
PyPI, the central package repository for Python, is also tightening its security. Administrators can no longer add new files to a release published more than fourteen days ago. The platform aims to prevent attackers from adding malicious files to an older, trusted version of a package after stealing publication tokens.
According to PyPI, in practice, it is extremely rare for developers to upload new files to a release that is older than two weeks. The new restriction, therefore, has little impact on regular development processes. At the same time, it closes off a potential attack vector.
It is noteworthy that PyPI states it is not aware of any confirmed attacks in which this so-called “release poisoning” technique has actually been used. The measure is therefore primarily intended as a preventive measure. By removing this possibility now, the administrators hope to prevent attackers from exploiting this route in the future.