GitHub's Dependabot malware alert system has expanded its coverage from a single ecosystem, npm, to include seven additional package ecosystems: PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. This enhancement, which became active in August 2026, allows Dependabot to issue malware alerts for packages across all eight supported ecosystems, provided users enable the feature.
The expansion was made possible by integrating GitHub's Advisory Database with the OpenSSF's malicious-packages repository. This public feed, launched in 2023, provides malware reports in OSV format and has accumulated over 15,000 entries covering various threats such as typosquatting, dependency confusion, account takeovers, and malicious prebuilt binaries. Previously, Dependabot's malware detection relied solely on npm data.
Instead of developing separate detection systems for each ecosystem, GitHub engineered a single importer to process the OpenSSF feed. This importer maps the external data into GitHub's existing advisory structure, similar to how it handles RubySec and RustSec advisories. The process involved normalizing data discrepancies, such as differing ecosystem names (e.g., "PyPI" versus "pip"), converting discrete version values into ranges, and consolidating multiple reports for the same package. The system also accounts for retracted advisories, which are stored in a dedicated "osv/withdrawn" folder within the OpenSSF repository.
A key challenge in integrating the OpenSSF feed was avoiding a feedback loop, as GitHub's own npm malware findings already contribute to the OpenSSF repository. To address this, the importer filters out any OSV records tagged "ghsa-malware," which originate from GitHub. This filtering proved crucial, as over half of the new npm reports arriving monthly were found to be such round-trip entries.
Unlike vulnerability advisories, which undergo human review for package mappings, version ranges, and severity before publication, malware advisories are published automatically. This expedited process is intentional, as delaying alerts for credential-stealing packages would benefit attackers. The recent expansion now allows these unreviewed malware advisories to directly trigger Dependabot alerts, a capability that was not available before.
To safeguard against potential compromise of the upstream OpenSSF feed, GitHub has implemented several protective measures. A batch cap limits the number of advisories created in a single import run; exceeding this cap halts the process, publishes nothing, and alerts the engineering team. Every imported advisory retains provenance linking it to the specific upstream commit, enabling rapid tracing of any erroneous advisories. Additionally, entire batches can be reverted as a single unit, streamlining the removal of problematic records.
Dependabot's malware alerts are an opt-in feature. Users must enable them within their repository, organization, or enterprise security settings. Once activated, Dependabot will begin matching dependencies against malware advisories in the Advisory Database, including a backfill against existing advisories. Dependabot currently operates across more than 30 million repositories and over 34 package ecosystems.
