GitHub has introduced a default three-day cooldown period for Dependabot version updates to reduce the risk of projects automatically adopting new malicious packages.
This change targets a prevalent pattern in software supply chain attacks where attackers compromise a trusted package maintainer’s account, publish a malicious update, and rely on automated dependency tools to distribute it before the package is detected and removed.
In September 2025, attackers reportedly phished an npm maintainer. They used the access to publish trojanized versions of popular packages, including chalk and debug.
The affected packages received more than 222 billion downloads each week. The malicious code replaced cryptocurrency wallet addresses in browser-based applications, potentially redirecting payments to attacker-controlled wallets.
Although npm removed these malicious releases within about two hours, that timeframe was sufficient for automated update systems to identify the new versions and create pull requests in downstream repositories.
GitHub Adds 3-Day Dependabot Cooldown
Teams that merged these pull requests without careful review might have unintentionally introduced the malicious dependency into their applications.
Dependabot is GitHub’s dependency management tool that performs two distinct functions: Dependabot security updates address known vulnerabilities by creating pull requests for patched versions, while Dependabot version updates refresh packages when new releases are published, even if no known security flaw exists.
The new three-day delay applies only to standard version updates. Dependabot security updates will still open immediately, as delaying a patch for a publicly disclosed vulnerability could leave projects exposed.
GitHub stated that this cooldown period allows package maintainers, security researchers, registry operators, and automated scanning systems more time to identify and remove malicious releases before they reach development teams.
Although the protection is enabled by default, repository maintainers can modify the delay through the cooldown configuration in the dependabot.yml file. This approach is based on evidence that malicious package releases are often detected quickly.
GitHub referenced incidents involving compromised releases of axios, @solana/web3.js, ua-parser-js, and Ledger Connect Kit, where poisoned versions were generally identified within hours.
GitHub’s Advisory Database also highlights the increasing scale of npm malware activity. In the year ending May 2026, the database recorded over 6,500 npm malware advisories, compared to roughly 6,200 in the previous year. This represents about 18 malicious npm packages cataloged each day.
The three-day waiting period is designed to mitigate the high-risk period immediately following publication while still keeping dependencies relatively current. Organizations with varying risk tolerances can configure a shorter or longer delay, including separate policies for internal packages and public registries.
However, GitHub cautioned that cooldowns are not a comprehensive solution for supply chain security. They may not prevent long-term backdoors, malicious behavior from trusted maintainers, or compromises of build and release infrastructure.
Teams should use this feature alongside lockfiles, manual pull request reviews, restricted CI/CD tokens, and controls that disable dependency install scripts whenever possible.
This new default adds a layer of protection against fast-moving package attacks, helping developers avoid placing automatic trust in every newly published version.
