# GitHub expands malware advisories from npm to eight package ecosystems

_Published Friday, October 16, 2026 at 3:20 PM EDT · Security · Latest · Tier 2 — Notable_

GitHub has integrated OpenSSF's malicious-package reports into its Advisory Database, expanding malware coverage from npm to eight package ecosystems, OpenSSF said. The collection now covers npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io and PHP Composer.

Dependabot checks dependencies against those advisories and alerts developers to matches when malware alerts are enabled. Users who already enabled the alerts receive the expanded coverage without additional configuration.

GitHub's importer validates reports, handles withdrawn advisories and avoids reimporting its own contributions. Malware alerts remain opt-in; teams whose internal packages share names with malicious public packages can use auto-triage rules to reduce false positives.

## Sources

- [Open Source Security Foundation](https://openssf.org/blog/2026/10/16/case-study-github-expands-malware-advisories-across-eight-ecosystems-with-openssf/)

---
Canonical: https://techandbusiness.org/newswire/pE_xtK13Mfkuzjm-k3UdgN
Published: 2026-10-16T19:20:12.304Z
Story chronology: 2026-10-16T19:06:29.000Z
Retrieved: 2026-10-16T23:06:58.405Z
Publisher: Tech & Business (techandbusiness.org)