Dependabot alerts on malicious packages across more ecosystems

GitHub's Advisory Database now ingests malware advisories from the OpenSSF malicious-packages repository, expanding Dependabot's malware alert coverage beyond npm to additional ecosystems including PyPI. Repositories with malware alerting already enabled automatically benefit from the broader coverage with no configuration changes required. New advisories will trigger alerts as they are published, and users can browse them using the type:malware filter on github.com/advisories.

Source: https://github.blog/changelog/2026-07-28-dependabot-alerts-on-malicious-packages-across-more-ecosystems. 8sync News only summarizes and links out; content copyright belongs to the authors and original sources.