The past year has seen a surge in high-profile supply chain attacks targeting development ecosystems, including notable incidents like the 'chalk' and 'debug' attacks, the 's1ngularity' operation, the **Shai-Hulud** campaign, and the **GhostAction** supply-chain attack. In response, both **GitHub** and **PyPI** are implementing new measures to harden their platforms. ### GitHub Introduces Dependabot Cooldown **Dependabot**, **GitHub**'s dependency-update service, is now equipped with a default three-day (72-hour) cooldown period before issuing version updates. This delay is designed to create a crucial window for security tools and human intervention to detect and flag newly published malicious packages before they are automatically adopted into projects. While many malicious packages are detected within minutes of publication, the time required for maintainers and vendors to remove them still poses a risk. **GitHub** selected the three-day period as a balance between mitigating risks and ensuring projects can still access the latest legitimate upgrades. Users retain the flexibility to configure shorter or longer delays via **Dependabot**'s 'cooldown' option. **GitHub** also emphasized that while the cooldown is a valuable addition, it's not a standalone solution against long-term compromises. The platform recommends additional security practices such as using lockfiles for dependency pinning, employing restricted-scope tokens, and disabling unnecessary installation scripts in CI/CD pipelines. ### PyPI Blocks Release Poisoning with 14-Day Cutoff **PyPI** has implemented a new policy that prevents maintainers from adding new files to a package release more than 14 days after its initial publication. This measure directly addresses the risk of attackers compromising publishing tokens or workflows to poison older, trusted releases with malicious code. Analysis by **PyPI** revealed that only a very small percentage of projects legitimately uploaded files more than two weeks after a release. Although no known past attacks on **PyPI** have been confirmed to use this specific release poisoning technique, the platform is taking a proactive stance to block this dangerous potential attack vector.