Back Feeds2.Feedburner

GitHub Dependabot malware alerts now cover eight ecosystems

Feeds2.Feedburner •Mirko Zorz • August 10, 2026

GitHub has flagged npm malware since March 2026. Anyone pulling in a bad PyPI, Maven, RubyGems, NuGet, Go, crates.io, or PHP Composer package has had no such warning, because GitHub’s malware detection only ever watched one ecosystem. That changed this month. GitHub’s Advisory Database now ingests malware reports from OpenSSF’s malicious-packages repository, a public feed in OSV format that launched in 2023 with more than 15,000 reports and has grown daily since, covering typosquats, dependency-confusion … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GitHub Expands Dependabot Malware Alerts to Eight Ecosystems GitHub has expanded its Dependabot malware alerts to include eight ecosystems: npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. This change, effective August 2026, allows for automatic ingestion of malware reports from OpenSSF's malicious-packages repository, which has over 15,000 reports. Previously, alerts were limited to npm, leaving other ecosystems vulnerable to undetected malware. The new system aims to enhance security for developers by providing timely alerts without the delays of human advisory reviews. This update reflects a growing need for comprehensive malware detection across multiple package ecosystems, addressing issues like typosquats and dependency confusion. The integration is expected to improve the overall security posture of software development environments. Current users of these ecosystems should be aware of the increased monitoring and potential alerts regarding malicious packages. 4 sources 43

Extracted Entities

GitHub Dependabot malware alerts now cover eight ecosystems

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Platforms (6)

Tools (1)