Dependabot alerts expand to cover malicious packages from OpenSSF
GitHub's Dependabot alerts now incorporate malware advisories from the OpenSSF malicious-packages repository, broadening detection across ecosystems like npm and PyPI. This enhancement means users with malware alerting enabled will automatically benefit from expanded coverage, identifying risks from newly published malicious packages. To leverage this, users can enable malware alerting in repository settings or browse advisories directly on GitHub.
- →Dependabot alerts now identify malicious packages via OpenSSF data
- →Automatic malware alerting with expanded ecosystem coverage
- →How to enable malware alerting for Dependabot
Features (1) ›
- Dependabot alerts now identify malicious packages via OpenSSF data
Dependabot alerts now ingest malware advisories from the OpenSSF malicious-packages repository, expanding coverage across ecosystems such as npm and PyPI. Users can view these advisories using the type:malware filter.
Enhancements (1) ›
- Automatic malware alerting with expanded ecosystem coverage
With malware alerting enabled, Dependabot will automatically match dependencies against the expanded set of malware advisories. New advisories from the OpenSSF data source will trigger alerts as they are published, without requiring additional configuration.
Notes (1) ›
- How to enable malware alerting for Dependabot
Users who have not yet enabled malware alerting can navigate to repository or organization Settings > Code security > Dependabot and enable Malware alerts. Malware advisories can also be browsed directly at github.com/advisories.
https://github.blog/changelog/2026-07-28-dependabot-alerts-on-malicious-packages-across-more-ecosystems
Related releases
- CodeQL 2.26.1 enhances analysis accuracy and framework coverage GitHub Changelog ·
- GitHub Copilot App Usage Metrics Expanded in API GitHub Changelog ·
- npm Adds Publish-Time Malware Scanning and Dual-Use Metadata GitHub Changelog ·
- Grok 4.5 reasoning model available in GitHub Copilot GitHub Changelog ·
- GitHub Actions holds workflows for approval to prevent attacks GitHub Changelog ·
- GitHub Actions holds potentially malicious workflows for approval GitHub Changelog ·