GitHub Expands Dependabot Malware Alerts to Eight Ecosystems

Feeds.4Sysops

GitHub Expands Dependabot Malware Alerts to Eight Ecosystems

First seen 10 Aug 2026, 09:31 UTC • •42.9

Article Content

1 / 5

Browse articles

ThreatCluster •August 11, 2026 at 08:07 UTC

•Dependabot now covers eight ecosystems, enhancing malware detection capabilities.
•Automatic ingestion of malware reports allows for faster alerts to developers.
•Over 15,000 malware reports are now accessible through GitHub's Advisory Database.

GitHub has expanded its Dependabot malware alerts to include eight ecosystems: npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. This change, effective August 2026, allows for automatic ingestion of malware reports from OpenSSF's malicious-packages repository, which has over 15,000 reports. Previously, alerts were limited to npm, leaving other ecosystems vulnerable to undetected malware. The new system aims to enhance security for developers by providing timely alerts without the delays of human advisory reviews. This update reflects a growing need for comprehensive malware detection across multiple package ecosystems, addressing issues like typosquats and dependency confusion. The integration is expected to improve the overall security posture of software development environments. Current users of these ecosystems should be aware of the increased monitoring and potential alerts regarding malicious packages.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 62d ago How this analysis works

Timeline

2023-01-01

OpenSSF malicious-packages repository launched

The OpenSSF launched its repository with over 15,000 malware reports, growing daily.

Feeds2.Feedburner

2026-03-01

GitHub flags npm malware

GitHub initiated malware alerts for npm packages, marking the start of its malware detection efforts.

Feeds2.Feedburner

2026-08-01

Dependabot alerts expanded to eight ecosystems

GitHub announced the expansion of Dependabot alerts to include seven additional ecosystems beyond npm.

More articles in this cluster (4)

Threat Graph

9 entities, 13 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Malware
Supply Chain Attack
T1195 - Supply Chain Compromise

Affected Platform (5)

Maven
NuGet
PHP Composer
PyPI
RubyGems

Tool (1)

Npm

Relationships

Malware targets Maven
Malware targets NuGet
Malware targets PHP Composer
Malware targets PyPI
Supply Chain Attack targets Maven
Supply Chain Attack targets NuGet
Supply Chain Attack targets PHP Composer
Supply Chain Attack targets PyPI
T1195 - Supply Chain Compromise targets Maven
T1195 - Supply Chain Compromise targets NuGet
T1195 - Supply Chain Compromise targets PHP Composer
T1195 - Supply Chain Compromise targets PyPI
Npm related to RubyGems

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…