{
  "id": 231381,
  "title": "How we took malware advisories beyond npm",
  "url": "https://urgent.news/2026/08/06/how-we-took-malware-advisories-beyond-npm",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-06T16:51:12.000Z",
  "source": {
    "name": "GitHub Blog",
    "slug": "github-blog",
    "url": "https://github.blog/security/supply-chain-security/how-we-took-malware-advisories-beyond-npm/"
  },
  "original_language": "en",
  "account": "GitHub has expanded malware advisories from npm to eight ecosystems by leveraging OpenSSF's malicious-packages data. Dependabot, the supply chain security tool, now flags malware in dependencies across npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. This expansion happened quickly thanks to OpenSSF's existing malicious-packages repository, which provides structured, openly available malicious package data. The GitHub Advisory Database was updated to ingest this data, enabling the creation of malware advisories for all eight ecosystems. The import process involves validating OSV records against a strict schema and mapping required fields. The importer also handles various challenges such as differing ecosystem naming conventions, inconsistent version range formats, and empty details fields. To prevent inadvertent reimportation of its own data, the importer skips records tagged from GitHub's own efforts. The ingestion pipeline includes safeguards for handling potential bad data, such as batch caps to halt runs with unusually high advisory volumes and provenance tracking for each advisory to trace back to its original upstream data source.",
  "summary": "GitHub malware advisories no longer stop at npm. Here's how we wired OpenSSF's malicious-packages data into the Advisory Database, and why we built the pipeline paranoid. The post How we took malware advisories beyond npm appeared first on The GitHub Blog .",
  "key_points": [],
  "editors_take": "GitHub's rapid expansion of malware advisories to multiple ecosystems strengthens its supply chain security capabilities, largely by tapping into OpenSSF's openly available malicious package data.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}