How dependabot-missing-cooldown happens in GitHub Actions configuration and how to fix it
ANSWER_SUMMARY: The
dependabot-missing-cooldownvulnerability (CWE-1104: Use of Unmaintained Third-Party Components) occurs when Dependabot configurations lack acooldownperiod, allowing immediate updates to packages that may be malicious or compromised. In this GitHub Actions repository, the.github/dependabot.ymlfile at lines 3, 13, and 22 hadpackage-ecosystementries forgithub-actions,npm, anddockerwithout cooldown protection. The fix addscooldown: default-days: 7to each ecosystem, forcing a 7-day waiting period before Dependabot proposes updates to newly published versions, mitigating supply chain attacks where attackers publish malicious packages and immediately depend on them.
Introduction
In a recent security audit of a GitHub Actions workflow repository, our scanners flagged a high-severity configuration vulnerability that exemplifies a growing attack vector in modern software supply chains. The file .github/dependabot.yml—responsible for automated dependency management across three critical package ecosystems—lacked a crucial safeguard that left the door open to dependency confusion attacks and malicious package adoption.
The vulnerability wasn't in executable code, but in YAML configuration. Specifically, three package-ecosystem entries at lines 3, 13, and 22 managed updates for GitHub Actions, npm packages, and Docker images with weekly scheduling, but without any delay mechanism for newly published versions. This meant that a malicious actor could publish a compromised package to any of these registries and see it automatically proposed for integration within days—or potentially hours if manual triggers were used.
This is particularly dangerous for a Node.js library, as vulnerabilities in dependency management propagate downstream to all consumers of the package.
The Vulnerability Explained
The Problematic Configuration
Before the fix, the .github/dependabot.yml file contained three unprotected ecosystem configurations:
# Line 3-11: GitHub Actions ecosystem
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
# MISSING: cooldown configuration
groups:
actions:
patterns:
- "*"
# Line 13-21: npm ecosystem
- package-ecosystem: npm
directory: /
schedule:
interval: weekly
# MISSING: cooldown configuration
groups:
devtools:
patterns:
- "*"
# Line 22-26: Docker ecosystem
- package-ecosystem: docker
directory: /
schedule:
interval: weekly
# MISSING: cooldown configuration
Why This Creates a Supply Chain Risk
The schedule.interval: weekly setting only controls when Dependabot checks for updates—not how long a package must exist before being considered. Without a cooldown period, Dependabot would immediately propose updates to any package version published since the last check, regardless of how fresh that release is.
This enables several attack scenarios:
| Attack Vector | How It Exploits Missing Cooldown |
|---|---|
| Malicious Package Publication | Attacker publishes typosquatted or compromised package to npm; Dependabot proposes it within a week |
| Dependency Confusion | Attacker publishes private package name to public registry with higher version; immediate adoption proposed |
| Compromised Maintainer Account | Legitimate package compromised, malicious version published; no grace period for community detection |
| Registry Poisoning | Attacker exploits registry vulnerability to inject malicious metadata; picked up by automation |
For the github-actions ecosystem specifically, this is especially critical—compromised Actions can exfiltrate repository secrets, modify source code, or pivot to production environments with elevated privileges.
Real-World Impact for This Repository
As a Node.js library, this repository's dependencies flow downstream to numerous consumers. A malicious npm package adopted here would propagate through the dependency tree, potentially affecting:
- CI/CD pipelines of dependent projects
- Production applications using this library
- Developer environments where this package is installed
The Docker ecosystem configuration posed additional risks for containerized deployments, where base image compromises can persist undetected in production workloads.
The Fix
Specific Changes Made
The remediation added a cooldown block with default-days: 7 to all three package-ecosystem entries in .github/dependabot.yml:
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,8 @@ updates:
directory: /
schedule:
interval: weekly
+ cooldown:
+ default-days: 7
groups:
actions:
patterns:
@@ -13,6 +15,8 @@ updates:
directory: /
schedule:
interval: weekly
+ cooldown:
+ default-days: 7
groups:
devtools:
patterns:
@@ -22,3 +26,5 @@ updates:
directory: /
schedule:
interval: weekly
+ cooldown:
+ default-days: 7
How This Solves the Problem
The cooldown configuration introduces a mandatory waiting period before Dependabot will propose updates to newly published package versions:
| Aspect | Before Fix | After Fix |
|---|---|---|
| Package published to registry | Immediately eligible for update proposal | Must age 7 days first |
| Attacker's malicious package | Proposed to maintainers within 1 week | Blocked for 7 days; likely detected and removed |
| Community vetting window | None guaranteed | 7-day buffer for security researchers and consumers to identify issues |
| Emergency security patches | Same-day updates possible | Still possible via manual override |
The default-days: 7 value was selected as a balanced approach—long enough for the open-source community to identify most malicious publications (research suggests 70% of malicious npm packages are detected within 48 hours), while not unduly delaying legitimate security patches.
Why All Three Ecosystems Needed Protection
Each ecosystem presents unique supply chain risks:
- github-actions: Actions run with repository secrets and broad permissions; compromised Actions have immediate, high-impact access
- npm: JavaScript's ecosystem has experienced numerous dependency confusion and typosquatting attacks
- docker: Base image compromises can introduce persistent backdoors in containerized workloads
Applying the cooldown consistently across all three ensures no single vector remains unprotected.
Prevention & Best Practices
Configuration Security for Dependabot
-
Always include
cooldownfor production repositories
yaml cooldown: default-days: 7 # Minimum recommended; consider 14-30 for critical systems -
Differentiate cooldown periods by risk profile
yaml # Higher risk ecosystems get longer cooldowns - package-ecosystem: npm cooldown: default-days: 14 - package-ecosystem: github-actions cooldown: default-days: 7 # Shorter due to faster security patch needs -
Combine with additional Dependabot security features
- Enableopen-pull-requests-limitto control review burden
- Useignorepatterns for known problematic version ranges
- Configuregroupscarefully to avoid bundling high-risk updates -
Implement layered supply chain security
- Pin Action versions to full commit SHAs, not floating tags
- Usenpm ciwithpackage-lock.jsonverification in CI
- Scan containers with Trivy or Snyk before deployment
Detection Tools
| Tool | Rule/Feature | Coverage |
|---|---|---|
| Semgrep | package_managers.dependabot.dependabot-missing-cooldown |
Detects missing cooldown in .github/dependabot.yml |
| GitHub Advanced Security | Dependency review | Flags known-vulnerable versions in PRs |
| OpenSSF Scorecard | Dependency update tool check | Verifies automated dependency management practices |
Security Standards
- OWASP Software Component Verification Standard (SCVS): V1.2 requires verification of component authenticity and integrity
- SLSA (Supply-chain Levels for Software Artifacts): Level 2+ requires dependency pinning and verification
- NIST SSDF (Secure Software Development Framework): PO.3.2 emphasizes managing software supply chain risks
Key Takeaways
- The
schedule.intervalsetting does NOT protect against fresh malicious packages—onlycooldownenforces a minimum package age before Dependabot proposes updates - All three
package-ecosystementries in this repository (github-actionsat line 3,npmat line 13,dockerat line 22) required identicalcooldown: default-days: 7protection - 7 days provides adequate community detection time for most supply chain attacks while balancing legitimate security patch needs
- Configuration files are code—
.github/dependabot.ymlchanges should undergo the same security review as application code - Downstream impact amplifies supply chain risks—Node.js libraries must maintain higher dependency security standards due to transitive consumption
How Orbis AppSec Detected This
| Aspect | Details |
|---|---|
| Source | Public package registries (npm, GitHub Actions Marketplace, Docker Hub) where attackers can publish arbitrary packages |
| Sink | The .github/dependabot.yml file's package-ecosystem entries at lines 3, 13, and 22, which configured automated update proposals without age verification |
| Missing control | No cooldown configuration to enforce a minimum package publication age before update eligibility |
| CWE | CWE-1104: Use of Unmaintained Third-Party Components (extends to insufficient vetting of newly published components) |
| Fix | Added cooldown: default-days: 7 to all three package-ecosystem entries, creating a mandatory 7-day waiting period for newly published package versions |
Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.
Conclusion
Supply chain security demands defense in depth. While tools like Dependabot automate the tedious work of dependency management, their default configurations often prioritize convenience over security. The dependabot-missing-cooldown vulnerability reminds us that automation without safeguards can accelerate attacks, not just defenses.
The 7-day cooldown added to this repository's configuration is a small change with outsized impact—transforming a potential attack vector into a protective buffer. For maintainers of libraries and applications alike, this pattern should be standard practice: verify before you automate, and never let convenience compromise your supply chain integrity.
Review your .github/dependabot.yml today. If you don't see cooldown configuration, you're vulnerable to the same attack—and the fix takes less than a minute to implement.