On September 8, 2025, a phished npm maintainer’s credentials let an attacker push poisoned versions of chalk, debug, and about a dozen other packages, downloaded more than 2 billion times a week combined. The compromised debug@4.4.2 build rewrote crypto wallet addresses inside any browser app that loaded it. npm pulled the bad versions within roughly two hours. Two hours is a fast catch. It’s also long enough for an automated update tool to spot the release, open a pull request, and put malicious code in front of a reviewer who trusts the bot.
I read GitHub’s changelog entry the day it dropped: as of July 14, 2026, Dependabot’s default behavior holds non-security version updates for at least three days after a release publishes, tunable through the cooldown key in dependabot.yml. Security updates still fire the moment an advisory lands, since sitting on a public fix helps nobody.
The old yardstick for a dependency bot was speed: catch the release, open the PR, get it merged. The new yardstick is patience. GitHub’s advisory database logged more than 6,500 npm malware advisories in the year ending May 2026, about 18 a day, and most get caught within hours of publishing. Three days pushes past that window without holding dependencies back for long.
Carlin Cherry, the GitHub product manager who owns Dependabot, already named the limit: cooldowns do little against “backdoors planted in releases and left dormant, maintainer sabotage, or a compromised build system.” Cooldowns filter what moves fast. They don’t touch code planted months ahead and left dormant.
Worth auditing your own dependabot.yml this quarter, before the next fast-moving hijack tests the default.
Rebecca Lauren