Supply Chain · Watch Sunday · 26 July 2026 End-of-day synthesis 4 watches · 1 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — The only story of the day was a defensive one — GitHub and PyPI shipped a built-in cooldown window for Dependabot, and nothing else moved.

Sunday's fetch runs came back nearly empty across the board: no new GHSA disclosures, no new CISA KEV catalog entries, and nothing fresh from Socket, Phylum, Aikido, or Hacker News since this morning's pass. The day's only development was a defensive one, not an attack.

GitHub and PyPI added a configurable cooldown window to Dependabot — a multi-day delay between a package version publishing and Dependabot proposing it as an update. Most compromised packages get caught and yanked within hours of the first report, so a few days of lag keeps automated dependency bumps from ever landing on a version whose only track record is being live malware; it's the same "let the community find it first" logic distro maintainers have leaned on for decades, now built into tooling millions of CI pipelines already trust.

→ Operational priority for the night turn cooldown on for PyPI and npm ecosystems in your Dependabot config, and pair it with trusted publishing and disabled install scripts rather than treating the delay alone as sufficient.

12:00 ET · Forenoon Watch

Medium · BleepingComputer · medium · npm/PyPI · Dependabot cooldown timing defense ·added 12:00 ET

GitHub, PyPI add time-based defenses against supply chain attacks

GitHub's Dependabot now supports a configurable cooldown window on PyPI and npm updates — a delay of several days between a new version publishing and Dependabot proposing it — rather than proposing every release the moment it lands. Compromised packages are typically caught and yanked within hours of the first report, so a multi-day cooldown keeps auto-update pipelines from ever resolving a version whose only existence was as live malware; it's the same "let the community find it first" logic Linux distros have used for decades, now built into dependency automation. Turn cooldown on for PyPI/npm ecosystems in your Dependabot config — a few days is enough to dodge most yank-and-run compromises — but pair it with trusted publishing and disabled install scripts rather than treating timing alone as the fix.