GitHub now applies a mandatory three-day cooldown period for package version updates to help catch malicious code before it enters production environments. By delaying pull requests, this strategy prevents the automated ingestion of compromised packages that are typically identified shortly after publication.