SecurityWeek

New GitHub, PyPI Policies Boost Supply Chain Security

GitHub’s Dependabot waits three days before opening pull requests, and PyPI rejects file uploads to releases older than 14 ...
Techzine Europe

GitHub and PyPI are delaying updates to reduce attackers’ opportunities

GitHub and PyPI are implementing new measures to better protect software developers against attacks via the software supply ...
Windows Report on MSN

GitHub adds three-day Dependabot cooldown to block supply-chain attacks

GitHub adds a three-day Dependabot cooldown, while PyPI restricts changes to older releases to reduce supply-chain attack ...
VentureBeat

GitHub confirms 3,800 internal repos stolen through poisoned VS Code extension as supply chain worm hits Microsoft’s Python SDK

GitHub confirmed on May 20 that a poisoned VS Code extension installed on an employee’s device gave attackers access to roughly 3,800 internal repositories at the Microsoft-owned code storage and ...