How we took malware advisories beyond npm
GitHub malware advisories no longer stop at npm. Here's how we wired OpenSSF's malicious-packages data into the Advisory Database, and why we built the pipeline paranoid. The post How we took malware advisories beyond npm appeared first on The GitHub Blog .
GitHub has expanded malware advisories from npm to eight ecosystems by leveraging OpenSSF's malicious-packages data. Dependabot, the supply chain security tool, now flags malware in dependencies across npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. This expansion happened quickly thanks to OpenSSF's existing malicious-packages repository, which provides structured, openly available malicious package data.
The GitHub Advisory Database was updated to ingest this data, enabling the creation of malware advisories for all eight ecosystems. The import process involves validating OSV records against a strict schema and mapping required fields. The importer also handles various challenges such as differing ecosystem naming conventions, inconsistent version range formats, and empty details fields.
To prevent inadvertent reimportation of its own data, the importer skips records tagged from GitHub's own efforts. The ingestion pipeline includes safeguards for handling potential bad data, such as batch caps to halt runs with unusually high advisory volumes and provenance tracking for each advisory to trace back to its original upstream data source.
Written by urgent.news from GitHub Blog's reporting — not their text. Machine-written — it may contain errors, so check the original before relying on it.
