Between a Rock and a Hard Place: When Dependency Cooldowns and CVE Policies Deadlock the Build

On a recent call, a security lead walked us through two rules his team enforces on every build. Both are sensible. Together, they left his developers with a red pipeline and no version of a library they were allowed to use.

The first rule is a cooldown. A new open source release cannot enter the build until it has been public for a set number of days. The second rule blocks any library version with a known high or critical vulnerability. The trouble starts when both rules apply to the same library at once.

Why cooldowns caught on

Cooldowns exist because attackers now hide malware in new releases. Earlier this month, version 0.5.144 of the tensorlake npm SDK was published with Shai-Hulud malware that steals GitHub secrets and cloud credentials. The package averages about 12,000 weekly downloads. Any team that installed that version got the malware. On October 13, Bloom Security also revealed a now-fixed flaw in npm's Trusted Publishing that had exposed more than 1,500 packages to takeover.

Malicious releases tend to get caught fast, so a cooldown lets someone else find them first. The pnpm docs say it directly: "In most cases, malicious releases are discovered and removed from the registry within an hour." Since version 11, pnpm waits 24 hours before it installs a new release by default.

Two rules, zero versions

Say a new high-severity advisory comes out for a library the team already uses. The vulnerability rule now blocks the version in the lockfile, so yesterday's green build fails today. The maintainers have already released a fixed version, but it came out yesterday, and the cooldown blocks that one too.

Every version the team could pull is now blocked by one rule or the other. That is where the team on our call ended up. Their only choices were to wait with a red pipeline, or to grant a broad exception that quietly weakens one of the rules.

AI turned up the volume

This used to be an occasional headache. AI vulnerability research is making it a regular one.

In May, Anthropic reported that it and about 50 partners had found more than 10,000 high- or critical-severity vulnerabilities with its Claude Mythos Preview model. On October 8, Anthropic opened a free, opt-in scanner for important open source projects, built on its strongest models. Anthropic's disclosure dashboard already lists 6,157 vulnerabilities reported across 591 projects as of October 2.

OpenAI is on the same path. In March, it reported that its Codex Security agent, first announced as Aardvark, was tested against 1.2 million commits over 30 days. By OpenAI's own count, it flagged nearly 800 critical and more than 10,000 high-severity findings.

Finding these bugs is good news. But the ones in open source libraries become advisories against code people run, and a vulnerability rule blocks those versions. Only 516 of the findings on Anthropic's dashboard are patched so far. Each patch still to come brings a fresh advisory and a fresh release, which is the pair that triggers both rules.

Keeping both rules

The team didn't need a new release. They needed the fix.

A backport takes the security fix and applies it to the version already in the lockfile. Nothing else in the library changes, so there is no upgrade to wait for, and the build passes both rules again.

Seal Security does this for you. We backport fixes into the versions you already use, and we review and test every patch before it reaches your build.

Our pre-CVE program goes a step further. We watch upstream projects for security fixes that come out before a CVE is published, so the patched version is already in your build when the advisory appears, and the vulnerability rule has nothing to block.

See it live on October 21

Fixing vulnerabilities without upgrading is on the agenda of a free webinar hosted by Up Security and the CloudAppSec IL community. It runs on October 21, from 11:00 to 12:25 Israel time. The session covers privacy, supply chain security, and handling vulnerabilities without breaking production, including a live demo of patching open source libraries in place.

Alon Navon, Seal's CPO, joins Up Security's Head of Privacy, Ayala Aligula, and its CISO, Tomer Barhoum. Register for the webinar.