Dependabot alerts expand to cover malicious packages from OpenSSF
GitHub's Dependabot alerts now incorporate malware advisories from the OpenSSF malicious-packages repository, broadening detection across ecosystems like npm and PyPI. This enhancement means users with malware alerting enabled will automatically benefit from expanded coverage, identifying risks from newly published malicious packages. To leverage this, users can enable malware alerting in repository settings or browse advisories directly on GitHub.
- →Dependabot alerts now identify malicious packages via OpenSSF data
- →Automatic malware alerting with expanded ecosystem coverage
- →How to enable malware alerting for Dependabot
Features (1) ›
- Dependabot alerts now identify malicious packages via OpenSSF data
Dependabot alerts now ingest malware advisories from the OpenSSF malicious-packages repository, expanding coverage across ecosystems such as npm and PyPI. Users can view these advisories using the type:malware filter.
Enhancements (1) ›
- Automatic malware alerting with expanded ecosystem coverage
With malware alerting enabled, Dependabot will automatically match dependencies against the expanded set of malware advisories. New advisories from the OpenSSF data source will trigger alerts as they are published, without requiring additional configuration.
Notes (1) ›
- How to enable malware alerting for Dependabot
Users who have not yet enabled malware alerting can navigate to repository or organization Settings > Code security > Dependabot and enable Malware alerts. Malware advisories can also be browsed directly at github.com/advisories.
https://github.blog/changelog/2026-07-28-dependabot-alerts-on-malicious-packages-across-more-ecosystems
Related releases
- GitHub Copilot Enterprise Teams Model Policy Targeting in Public Preview GitHub Changelog ·
- npm restricts granular access token ability to bypass 2FA for sensitive actions GitHub Changelog ·
- GitHub Models officially retired GitHub Changelog ·
- GitHub Copilot VS Code Updates: Agents, Chat, UI, and Accessibility GitHub Changelog ·
- GitHub Actions: Reference same-repo workflows with self-repository syntax GitHub Changelog ·
- GitHub Stacked Pull Requests Enter Public Preview GitHub Changelog ·