How Danggeun Responds to Python Supply Chain Attacks

Prompted by the supply chain attacks that continued from LiteLLM to telnyx, Danggeun applied a dependency cooldown to its internal PyPI proxy. The core idea is to reduce the short exposure window between when a package is just uploaded and when it gets detected and quarantined.

Internal distribution is managed with AWS CodeArtifact, but having users handle AWS credentials and tokens every time makes configuration complicated across local, CI, and Dockerfile environments. So they put a proxy in front, arranging things so users only need to use pip or uv.

The proxy automatically manages CodeArtifact tokens internally. Tokens are issued with a 900-second lifetime, refreshed 300 seconds before expiry, and refresh timing across multiple instances is spread out using ±60-second jitter. /health checks not just process liveness but also token validity, and large wheel files are streamed in 8KB chunks instead of being loaded into memory.

The cooldown filter uses both PEP 503 and PEP 691 together.

• Clients are still served the existing PEP 503 HTML.
• Filtering decisions are made using the upload-time field from PEP 691 JSON, which contains the upload timestamp.
• Policy is controlled in real time via Central Dogma, allowing changes to whether it's enabled, the duration, and exception packages.

The cooldown has limitations, including delayed security patches and failure to catch existing malicious packages that are already undetected. Still, it created a defense line applied consistently across all internal environments, and it actually blocked downloads when pytorch-lightning 2.6.2 and 2.6.3 became targets of the same campaign on April 30, 2026.