GitHub delays version updates so malware gets caught first

GitHub's Dependabot now delays non-security version updates by three days before opening pull requests, preventing automatic integration of newly published malware during the typical two-hour window before detection. The change follows a September 2025 incident where poisoned npm packages (chalk, debug) reached 2 billion weekly downloads before removal.

This Wire brief sits within Fusion42's coverage of Enterprise Software, Cybersecurity and Data Infrastructure. Wire is Fusion42's founder-focused intelligence feed: each story is connected to the funds and startups it names — every one with a live profile on Raise or Scout — so founders can follow the capital and the momentum behind the headline rather than just the headline itself. Wire analysis is one of the live surfaces Arthur reasons over.