Back Feeds.4Sysops

Dependabot malware alerts jump from npm to eight ecosystems

Feeds.4Sysops •IT News • August 10, 2026

GitHub has expanded Dependabot malware alerts beyond npm to PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. The new pipeline can publish OpenSSF malware reports automatically, allowing alerts to reach administrators without waiting for the normal human advisory review. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GitHub Expands Dependabot Malware Alerts to Eight Ecosystems GitHub has expanded its Dependabot malware alerts to include eight ecosystems: npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. This change, effective August 2026, allows for automatic ingestion of malware reports from OpenSSF's malicious-packages repository, which has over 15,000 reports. Previously, alerts were limited to npm, leaving other ecosystems vulnerable to undetected malware. The new system aims to enhance security for developers by providing timely alerts without the delays of human advisory reviews. This update reflects a growing need for comprehensive malware detection across multiple package ecosystems, addressing issues like typosquats and dependency confusion. The integration is expected to improve the overall security posture of software development environments. Current users of these ecosystems should be aware of the increased monitoring and potential alerts regarding malicious packages. 4 sources 43

Dependabot malware alerts jump from npm to eight ecosystems

The full story

Extracted Entities

Attack Types (1)

Platforms (1)