GitHub has implemented a new default three-day cooldown period for Dependabot version updates to minimize the risk of projects inadvertently adopting harmful packages. This initiative aims to counteract a common method in software supply chain attacks, wherein attackers compromise a trusted package maintainer’s account to disseminate malicious updates before they are detected and removed.
Understanding the Motivation Behind the Cooldown
In a recent incident during September 2025, attackers successfully phished an npm maintainer, gaining access to distribute trojanized versions of widely-used packages such as chalk and debug. These compromised packages received over 222 billion downloads weekly, with the malicious code altering cryptocurrency wallet addresses in browser applications, potentially diverting funds to wallets controlled by attackers.
Although npm managed to eliminate these malicious releases within two hours, this window was sufficient for automated update systems to flag the new versions and generate pull requests in downstream repositories. Teams that merged these requests without thorough scrutiny risked introducing the malicious dependency into their systems.
Dependabot’s Role and the New Cooldown
Dependabot, GitHub’s tool for managing dependencies, offers two main functions. It provides security updates to address known vulnerabilities by suggesting patches, and it delivers version updates when new releases are available. The newly introduced three-day delay applies exclusively to standard version updates, ensuring that security updates are still deployed promptly to prevent exposure to known vulnerabilities.
GitHub indicated that this delay allows more time for package maintainers, security researchers, and automated systems to identify and eliminate malicious releases before they impact development teams. The cooldown is set as a default measure, but repository maintainers have the ability to adjust the delay through the dependabot.yml file.
Implications and Future Considerations
Despite this additional layer of security, GitHub cautions that cooldowns alone do not solve all supply chain security issues. They may not prevent long-term backdoors or malicious behavior from trusted sources. To enhance security, teams are advised to use lockfiles, conduct manual pull request reviews, and implement controls that limit dependency install scripts.
GitHub’s Advisory Database notes an increase in npm malware, with over 6,500 advisories recorded in the year ending May 2026, compared to 6,200 the previous year. The cooldown period is designed to mitigate risks during the critical period following a package’s publication while allowing dependencies to remain current. Organizations can tailor the delay duration according to their risk tolerance and policies for internal or public packages.
By introducing this cooldown period, GitHub enhances protection against swift-moving package attacks, encouraging developers to avoid blindly trusting every newly published version.
