SecurityWeek

New GitHub, PyPI Policies Boost Supply Chain Security

GitHub’s Dependabot waits three days before opening pull requests, and PyPI rejects file uploads to releases older than 14 ...

GitHub, PyPI add time-based defenses against supply chain attacks

GitHub and PyPI (Python Package Index) have introduced a time-based mechanism in the Dependabot dependency management tool to ...
The Hacker News

GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption

GitHub gives Dependabot version updates a three-day cooldown to curb short-lived poisoned packages, while security fixes ...
Techzine Europe

GitHub and PyPI are delaying updates to reduce attackers’ opportunities

GitHub and PyPI are implementing new measures to better protect software developers against attacks via the software supply ...
Windows Report on MSN

GitHub adds three-day Dependabot cooldown to block supply-chain attacks

GitHub adds a three-day Dependabot cooldown, while PyPI restricts changes to older releases to reduce supply-chain attack ...
VentureBeat

GitHub confirms 3,800 internal repos stolen through poisoned VS Code extension as supply chain worm hits Microsoft’s Python SDK

GitHub confirmed on May 20 that a poisoned VS Code extension installed on an employee’s device gave attackers access to roughly 3,800 internal repositories at the Microsoft-owned code storage and ...