An automated update tool watches a package registry, catches a new release the moment it publishes, and opens a pull request for your team. That is the job it was built to do. In September 2025, that speed cut the wrong way. An attacker phished one npm maintainer’s credentials and shipped poisoned versions of chalk
, debug
, and about a dozen other packages. Together those packages are downloaded more than 2 billion times a week, and the injected code rewrote cryptocurrency wallet addresses inside any browser app that loaded it.
The bad versions were live for about two hours before the community caught them and npm pulled them. Two hours is a fast cleanup. It is also enough time for an update tool to see the release, file a pull request, and set the malicious code in front of your reviewers.
GitHub’s Dependabot now waits. For non-security version bumps, it holds off at least three days after a release publishes before opening a pull request. The cooldown
option in dependabot.yml
controls the window, so a project can dial it up or down.
Two kinds of updates, one delay
Dependabot does two separate jobs. Security updates answer a known vulnerability: an advisory lands for a package you use, and Dependabot opens a pull request to move you onto the patched version. Version updates keep your dependencies current as new releases ship.
The three-day delay touches version updates alone. Security updates still open the moment an advisory drops, since holding one back would sit on a fix for a flaw the public already knows about.
Malware that lives for hours
A poisoned build of a popular package tends to have a short life. It publishes, spreads to whatever installs it, and gets caught, usually inside a few hours. Compromised versions of Solana web3.js, Axios, and ua-parser-js each followed that arc.
GitHub’s Advisory Database logged more than 6,500 npm malware advisories in the year ending May 2026.
That works out to about 18 freshly cataloged malicious npm packages a day. A cooldown keeps you out of that opening window and lets a release collect some scrutiny before it reaches you.
Why three days
A review of 21 widely reported supply chain incidents over the past several years found the same rhythm every time. The malicious version publishes, and within hours someone catches it and it comes down. A short waiting period would have filtered most of those publishes before anyone installed them.
Three days pushes you past the window where most of these attacks live. It also avoids holding your dependencies back longer than the job needs. Other tools in the community have settled on the same figure, which keeps behavior consistent for developers moving between them.
The attacks a cooldown misses
A cooldown assumes the malware moves fast. Carlin Cherry, a GitHub product manager who works on Dependabot, names the ones it misses: “It does little against attacks that play a longer game, including backdoors planted in releases and left dormant, maintainer sabotage, or a compromised build system.”
So a cooldown earns a place as one layer among several. Pin dependencies with lockfiles. Turn off install scripts in CI where you can. Scope the tokens in your build pipelines, and review updates before they merge.
The delay is on by default, and a project can tune the window or set different delays for trusted internal packages and public registries. It removes one fast, common path onto your machines. The rest of the supply chain still needs watching.