How we took malware advisories beyond npm

GitHub's supply chain team expanded malware detection to eight package ecosystems. Until recently, Dependabot alerts for malicious packages were limited to npm. Now the system covers PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. The breakthrough was building a single importer for OpenSSF's malicious-packages repository—which has grown to over fifteen thousand reports since twenty twenty-three—instead of building eight separate detection engines. The importer handles the unglamorous work: translating ecosystem names, mapping version ranges, and deduplicating reports that GitHub itself had contributed upstream. Because a compromised package can steal credentials the moment you install it, malware alerts auto-publish without human review. To protect against upstream data corruption, GitHub added three safeguards: batch caps that halt imports if volume spikes unexpectedly, provenance tracking to trace any advisory to its source commit, and rollback capability to purge a poisoned batch as a single unit. For developers, this means Dependabot will now alert you to malicious dependencies across most major package ecosystems, with malware alerts available as an opt-in feature across your repositories.

Listen to this story

Hear this and more stories in a personalized audio briefing.

Open The Chonkerton