GitHub expands malware advisories from npm to eight package ecosystems

GitHub has integrated OpenSSF's malicious-package reports into its Advisory Database, expanding malware coverage from npm to eight package ecosystems, OpenSSF said. The collection now covers npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io and PHP Composer. Dependabot checks dependencies against those advisories and alerts developers to matches when malware alerts are enabled. Users who already enabled the alerts receive the expanded coverage without additional configuration. GitHub's importer validates reports, handles withdrawn advisories and avoids reimporting its own contributions. Malware alerts remain opt-in; teams whose internal packages share names with malicious public packages can use auto-triage rules to reduce false positives.