GitHub has rolled out a new default security control for Dependabot, introducing a three-day cooldown period before version update pull requests are opened.
The change, announced by GitHub’s Carlin Cherry on July 23, 2026, directly targets a growing supply chain attack pattern where malicious code rides in on freshly published package versions and gets automatically pulled into build pipelines within minutes.
The catalyst example cited is the September 2025 npm supply chain compromise, where an attacker phished credentials from a single maintainer and published trojanized versions of chalk, debug, and roughly a dozen other packages collectively downloaded more than 2 billion times weekly.
GitHub Adds Three-Day Dependabot Cooldown
The malicious code rewrote cryptocurrency wallet addresses inside any browser application that loaded it.
The poisoned packages were live for approximately two hours before the community detected and removed them a fast response by industry standards, but still enough time for automated dependency tools to grab the new release and surface it in pull requests before any human or scanner could review it.
The three-day default applies exclusively to version updates, Dependabot’s routine mechanism for keeping dependencies current with new releases.
Security updates, which respond to published vulnerability advisories, still trigger immediately, since delaying a known fix would leave users exposed to a public flaw.
Maintainers can adjust the delay window through the existing cooldown configuration option in dependabot.yml, allowing teams to set shorter or longer periods based on their risk tolerance. GitHub’s rationale draws on incident data and its own Advisory Database.
Compromised builds of Solana web3.js, Axios, and ua-parser-js were each caught within hours of publication, consistent with a broader review of 21 supply chain incidents between 2018 and 2026, which found malicious versions of these and similar packages (including Ledger Connect Kit) pulled within hours in nearly every case.
The GitHub Advisory Database itself recorded more than 6,500 npm malware advisories in the year ending May 2026, up from roughly 6,200 the prior year, averaging about 18 newly cataloged malicious npm packages daily.
GitHub concludes that a cooldown window would have filtered out the majority of these short-lived malicious publishes before installation.
GitHub is explicit that the cooldown addresses one specific threat class: fast-moving attacks where malicious code ships, spreads, and gets caught quickly. It offers no protection against dormant backdoors, maintainer sabotage, or compromised build systems that play a longer game.
Security teams are advised to treat the cooldown as one layer among several, alongside lockfile pinning, disabling install scripts in CI environments, scoping build pipeline tokens, and manually reviewing dependency updates before merge.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
