GitHub and PyPI Introduce Time-Based Defenses Against Supply Chain Attacks
GitHub and PyPI both introduced time-based security measures this month that deliberately slow down the software supply chain. The idea is simple: make it harder for attackers to push malicious packages into your dependencies before anyone notices. Dependabot now has a default three-day cooldown before opening version update pull requests. PyPI will reject new file […]