In a coordinated wave of security hardening across the software supply chain, the Python Package Index (PyPI), npm, and GitHub have shipped overlapping defenses designed to disrupt the most common supply chain attack patterns. The changes, all announced in July 2026, target the full attack lifecycle from initial compromise through credential exfiltration to malicious package propagation.

Background

Supply chain security incidents follow a recognizable pattern: compromise a maintainer account or CI/CD pipeline, exfiltrate credentials, then publish poisoned packages that spread rapidly through automated dependency updates. In September 2025, a single phished npm maintainer account published malicious versions of chalk, debug, and roughly a dozen other packages downloaded over 2 billion times per week. The poisoned versions were live for approximately two hours before community detection and removal, plenty of time for automated tooling to pull them into build pipelines.

This incident and subsequent campaigns targeting solana-web3.js, axios, and ua-parser-js revealed a systemic weakness: the ecosystem optimizes for speed, not scrutiny. New releases propagate to downstream consumers within minutes, often before security researchers or maintainers can review them.

What Changed: PyPI 14-Day Upload Freeze

On July 22, 2026, PyPI began rejecting new file uploads to releases older than 14 days. The restriction, implemented in warehouse PR #19727, prevents attackers from poisoning long-stable releases even if they obtain valid publishing credentials.

Key details:

• Applies to all new file uploads (wheels, sdists) for releases created more than 14 days ago
• Does not affect creation of new releases; maintainers can still publish version 1.2.4 after version 1.2.3
• Only 56 of the top 15,000 PyPI packages had published Python 3.14-compatible wheels more than 14 days after their release, indicating minimal workflow disruption
• The change was debated since January 2024 (PEP 740 and Digital Attestations discussions) and accelerated after the LiteLLM/Telnyx supply chain security incidents in March 2026
• Consensus at the PyCon US 2026 Packaging Summit: acceptable to require users to bump to the next version for new Python version support

This measure directly addresses mutable reference attacks where compromised tokens are used to upload malware to existing, trusted releases rather than creating obviously suspicious new versions.

GitHub and npm: A Platform-Wide Hardening Sprint

GitHub July 28 blog post Disrupting supply chain attacks on npm and GitHub Actions documents a cascade of changes shipped between April and July 2026:

Initial Compromise Prevention

Feature	Date	Impact
npm preventive account protection	June 2026	High-impact accounts locked to read-only for 72 hours after email change or 2FA recovery
Safer pull_request_target defaults	June 2026	actions/checkout no longer checks out untrusted fork code by default in vulnerable triggers
Workflow execution policies	June 2026	Org/enterprise/repo controls over who can trigger workflows and which trigger types are allowed
Read-only Actions cache for untrusted triggers	June 2026	Prevents cache poisoning escalation from fork PR workflows to privileged release workflows

Credential Exfiltration Barriers

Feature	Date	Impact
npm trusted publishing + CircleCI	April 2026	OIDC-based publishing without long-lived tokens for CircleCI users
Actions network firewall (preview)	July 2026	Egress logging and future policy enforcement for Action workflows

Propagation Disruption

Feature	Date	Impact
npm staged publishing	May 2026	Published packages held pending 2FA approval; CI/CD credentials cannot directly publish
npm v12 install scripts disabled by default	June 2026	Blocks install-time credential exfiltration; scripts require explicit approval
Dependabot 3-day version update cooldown	July 23, 2026	Version update PRs wait 3 days; security updates still immediate

Incident Response Tooling

Feature	Date	Impact
Self-service credential revocation	June 2026	Enterprise admins and users can instantly revoke all credentials for a compromised identity
Expanded credential revocation API	March 2026	Supports OAuth and GitHub App tokens, not just PATs

Dependabot Three-Day Cooldown: Why It Matters

The Dependabot change deserves special attention because it flips the default behavior of the most widely used automated update tool. Previously, Dependabot opened version update PRs the moment a new release appeared. Now it waits three days by default.

The threat model: Malicious npm packages are typically caught and removed within hours. The 2025 chalk/debug incident: 2 hours. solana-web3.js: similar window. axios, ua-parser-js: hours. A three-day cooldown pushes automated adoption past the typical detection-and-takedown window.

Critical distinction: Security updates (vulnerability-driven) are exempt from the cooldown and open immediately. Only routine version updates are delayed.

Configuration: The cooldown key in dependabot.yml still controls behavior. Teams can shorten, extend, or disable it per registry or package pattern.

Practical Impact on Developer Workflows

For Package Maintainers

PyPI: If you need to add a new Python version wheel to an old release, you must now create a new patch release (e.g., 1.2.3 to 1.2.4) instead of uploading to 1.2.3. The PyPI team considers this an acceptable trade-off.

npm: Staged publishing is opt-in but recommended for high-value packages. Trusted publishing (OIDC) should be adopted to eliminate long-lived tokens entirely. npm v12 install-script default-off behavior may break packages that legitimately use prepare or install scripts; test in CI.

For Consumers

Dependabot: Expect fewer, later version update PRs. This is intentional. If you need faster updates for trusted internal packages, configure shorter cooldowns per package pattern.

GitHub Actions: Review workflow triggers. The new pull_request_target defaults and workflow execution policies reduce risk but may require explicit opt-out for legitimate fork-based CI patterns.

Comparison Table: Supply Chain Defenses Across Platforms

Defense Layer	PyPI	npm	GitHub Actions
Time-based release freeze	14-day upload block		Dependabot 3-day cooldown
Staged/guarded publishing		Staged publishing (opt-in)
Install-time execution control		npm v12: scripts off by default	Read-only cache for untrusted triggers
Credential-free publishing	Trusted publishing (OIDC)	Trusted publishing (OIDC, +CircleCI)
Account takeover mitigation		72-hour read-only on email/2FA change	Workflow execution policies
Incident response			Self-service credential revocation

Frequently Asked Questions

Q: Does PyPI 14-day rule break my CI/CD that publishes nightly builds? A: Nightly builds typically create new versions (e.g., 1.0.0.dev20260729), not upload to old releases. The restriction only affects adding files to existing releases older than 14 days.

Q: Will the Dependabot cooldown delay critical security fixes? A: No. Security updates triggered by GitHub Advisory Database entries open immediately. The cooldown only applies to routine version updates.

Q: How do I enable npm staged publishing? A: Run npm config set staged-publishes=true or configure in .npmrc. Published versions enter a staged state requiring 2FA approval via npm publish --access staged or the npmjs.com UI.

Q: What if my package legitimately needs install scripts in npm v12? A: Use npm pkg set scripts.prepare=... and approve scripts via npm config set ignore-scripts=false in CI, or use the new scripts.allow field in package.json (npm v12+).

Q: Can I opt out of GitHub safer pull_request_target defaults? A: Yes, by explicitly setting actions/checkout with persist-credentials: true and token: ${{ secrets.GITHUB_TOKEN }} in affected workflows, but review the pwn request guidance first.

Key Takeaways

1. The ecosystem is shifting from trust but verify to verify then trust. Time-based gates (14-day PyPI freeze, 3-day Dependabot cooldown) add mandatory scrutiny windows.
2. Long-lived credentials are the primary attack vector. Both PyPI and npm now support OIDC trusted publishing; adopt it to remove tokens from CI/CD entirely.
3. Staged publishing decouples CI from release authority. Even if CI is compromised, the attacker cannot ship to users without a second factor.
4. Install-time code execution is being restricted. npm v12 disables install scripts by default; GitHub Actions restricts cache writes from untrusted triggers.
5. Incident response tooling is maturing. Self-service credential revocation across OAuth, App tokens, and PATs means faster containment when breaches occur.

Conclusion

No single defense stops supply chain attacks. The July 2026 changes represent a layered approach: PyPI freezes the target (old releases), npm hardens the publishing pipeline (staged publishing, no install scripts), and GitHub secures the CI/CD substrate (workflow policies, cache isolation, Dependabot cooldown). Together they raise the cost of a successful attack from phish one maintainer, publish in minutes to a multi-stage operation requiring sustained access across multiple hardened surfaces.

For developers, the action items are clear: enable trusted publishing, review Dependabot cooldown settings, audit GitHub Actions workflow triggers, and adopt staged publishing for high-value packages. The ecosystem is becoming more secure by default; opt into the new protections rather than opting out.

---

Sources:

• PyPI Blog: Releases now reject new files after 14 days (July 22, 2026)
• GitHub Blog: Disrupting supply chain attacks on npm and GitHub Actions (July 28, 2026)
• GitHub Blog: The case for a cooldown: Why Dependabot now waits (July 23, 2026)
• GitHub Changelog: npm v12 breaking changes (June 2026)
• GitHub Changelog: Dependabot version updates cooldown (July 14, 2026)
• GitHub Changelog: Staged publishing for npm (May 2026)