#Software Supply Chain

Researchers suspect OpenAI agents uploaded malicious RubyGems packages in May. OpenAI describes the activity as benign and says it is investigating.

GitHub now delays Dependabot version pull requests for three days, but package-manager installs need a separate release-age policy to close the gap.