Introduction
In the .github/dependabot.yml file of a Node.js library, we discovered a high-severity configuration gap at line 3. The Dependabot configuration was set to check for npm package updates daily, but it lacked a critical safety mechanism: the cooldown block.
Here's the vulnerable configuration that was in production:
version: 2
updates:
- package-ecosystem: 'npm'
directories:
- '/'
schedule:
interval: 'daily'
This configuration tells Dependabot to propose updates as soon as new package versions are published—including packages that were uploaded just minutes ago. For a Node.js library with downstream consumers, this creates a significant supply chain risk.
The Vulnerability Explained
What Makes This Dangerous?
When a package maintainer's account is compromised, or when a malicious actor publishes a typosquatted package, the attack window is critical. Most supply chain attacks are discovered within the first few days of publication—but without a cooldown period, Dependabot could propose the malicious update before anyone notices.
Consider this attack timeline:
- Hour 0: Attacker compromises an npm package maintainer's credentials
- Hour 1: Attacker publishes version
2.1.0with a backdoor - Hour 2: Your Dependabot runs its daily check and creates a PR to update to
2.1.0 - Hour 3: A developer merges the PR, trusting the automated update
- Hour 24: Security researchers discover and report the compromise
- Hour 48: npm removes the malicious version
Without a cooldown, your project adopted the malicious package 46 hours before it was even flagged.
Real-World Impact for This Library
This isn't just theoretical. The vulnerable configuration was for a Node.js library—meaning any malicious dependency automatically proposed by Dependabot would propagate to every downstream consumer who installs or updates this package. The blast radius extends far beyond a single repository.
The npm ecosystem has seen numerous supply chain attacks:
- event-stream (2018): Compromised after ownership transfer
- ua-parser-js (2021): Hijacked maintainer account
- node-ipc (2022): Malicious code added by maintainer
In each case, there was a window of hours to days before the community identified the threat. A 7-day cooldown would have prevented automatic adoption in all these incidents.
The Fix
The fix adds exactly two lines to the Dependabot configuration:
Before (Vulnerable)
version: 2
updates:
- package-ecosystem: 'npm'
directories:
- '/'
schedule:
interval: 'daily'
After (Secure)
version: 2
updates:
- package-ecosystem: 'npm'
directories:
- '/'
schedule:
interval: 'daily'
cooldown:
default-days: 7
How This Solves the Problem
The cooldown block with default-days: 7 instructs Dependabot to wait 7 days after a package version is published before proposing it as an update. This creates a safety buffer that:
- Allows community vetting: Security researchers, automated scanners, and the broader community have time to analyze new releases
- Catches compromised packages: Most supply chain attacks are detected within 72 hours of publication
- Filters unstable releases: Packages with critical bugs are often patched quickly; waiting 7 days means you're more likely to get a stable version
- Maintains automation benefits: You still get automated dependency updates—just with a sensible delay
The change is minimal (2 lines) but the security improvement is substantial.
Prevention & Best Practices
Always Configure Cooldown Periods
For any Dependabot configuration, add a cooldown block to every package-ecosystem entry:
cooldown:
default-days: 7
For critical production systems, consider extending this to 14 or even 30 days.
Audit Your Existing Configurations
Search your organization's repositories for Dependabot configurations missing cooldown:
# Find all dependabot.yml files
find . -name "dependabot.yml" -exec grep -L "cooldown" {} \;
Use Semgrep for Automated Detection
The Semgrep rule package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown automatically detects this misconfiguration. Add it to your CI pipeline:
- name: Semgrep scan
run: semgrep --config "p/security-audit" .
Layer Your Defenses
Cooldown is one layer in a defense-in-depth strategy:
- Lock files: Always commit package-lock.json or yarn.lock
- Dependency review: Require manual review for dependency PRs
- SCA tools: Use Software Composition Analysis to scan for known vulnerabilities
- Subresource integrity: For CDN-loaded dependencies, use integrity hashes
Key Takeaways
- The missing
cooldownblock in.github/dependabot.ymlcreated a 0-day adoption window for potentially malicious npm packages - A 7-day cooldown period aligns with typical supply chain attack detection timelines
- Node.js libraries have amplified risk because vulnerabilities propagate to all downstream consumers
- This 2-line YAML change provides significant protection against supply chain attacks with zero impact on developer workflow
- Semgrep rule
dependabot-missing-cooldowncan detect this configuration gap automatically
How Orbis AppSec Detected This
- Source: Newly published npm package versions from the public registry
- Sink: Automatic PR creation by Dependabot in
.github/dependabot.yml:3 - Missing control: No
cooldownblock to delay adoption of new package versions - CWE: CWE-829 (Inclusion of Functionality from Untrusted Control Sphere)
- Fix: Added
cooldown: default-days: 7to the npm package-ecosystem entry, creating a 7-day buffer before new versions are proposed
Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.
Conclusion
Supply chain security isn't just about scanning for known CVEs—it's about building resilient configurations that protect against zero-day attacks. The missing Dependabot cooldown in this Node.js library represented a high-severity gap that could have allowed malicious packages to flow automatically into the codebase and, subsequently, to all downstream consumers.
The fix was simple: two lines of YAML. But the protection it provides is substantial. If you're using Dependabot, audit your configurations today and ensure every package-ecosystem entry includes a cooldown period. Your downstream users are counting on it.