GitHub delays version updates so malware gets caught first

GitHub's Dependabot now delays non-security version updates by three days before opening pull requests, preventing automatic integration of newly published malware during the typical two-hour window before detection. The change follows a September 2025 incident where poisoned npm packages (chalk, debug) reached 2 billion weekly downloads before removal.

This Wire brief sits within Fusion42's coverage of Enterprise Software, Cybersecurity and Data Infrastructure.