GitHub and PyPI implemented time-based mitigation mechanisms to reduce supply chain attack risks. Dependabot, GitHub's dependency update tool, enforces a default three-day cooldown before applying package updates, allowing time to detect malicious packages before automatic adoption. This cooldown is configurable by users. PyPI now rejects new file uploads to releases older than 14 days, preventing attackers from poisoning trusted older releases by compromising publishing credentials. These changes follow multiple supply chain attacks in the past year and are part of ongoing efforts to harden package ecosystems.

These defenses reduce the risk of automatically incorporating malicious or poisoned packages by introducing delays and restricting modifications to older releases. While no known attacks have exploited PyPI's release poisoning technique, the measures proactively block this potential threat. The cooldown in Dependabot limits rapid propagation of malicious packages, but does not eliminate longer-term compromise risks. Overall, these mitigations help limit the window of exposure to supply chain attacks in Python package ecosystems.

The time-based defenses are already implemented by GitHub and PyPI. Users should configure Dependabot cooldown settings according to their risk tolerance. GitHub recommends additional mitigations such as using lockfiles for dependency pinning, restricting token scopes, and disabling unnecessary installation scripts in CI environments. No further immediate action is required to address these specific threats beyond adopting these recommended best practices.