GitHub Adds 3-Day Dependabot Cooldown to Block Malicious Package Updates

GitHub is adding a default three-day cooldown to Dependabot version updates after incidents where attackers phished npm maintainers and published trojanized package releases (e.g., chalk, debug) that could redirect cryptocurrency payments; automated dependency tools previously created pull requests from those malicious releases before they were detected and removed. The change delays non-security version updates to give maintainers, researchers, and scanners time to detect and remove malicious releases, while keeping security updates immediate; the report notes a large and growing volume of npm malware advisories (about 6,500 in the year ending May 2026) and stresses that cooldowns are a mitigation, not a complete solution.