Dependabot alerts expand to cover malicious packages from OpenSSF
GitHub's Dependabot alerts now incorporate malware advisories from the OpenSSF malicious-packages repository, broadening detection across ecosystems like npm and PyPI. This enhancement means users with malware alerting enabled will automatically benefit from expanded coverage, identifying risks from newly published malicious packages. To leverage this, users can enable malware alerting in repository settings or browse advisories directly on GitHub.
- →Dependabot alerts now identify malicious packages via OpenSSF data
- →Automatic malware alerting with expanded ecosystem coverage
- →How to enable malware alerting for Dependabot
Features (1) ›
- Dependabot alerts now identify malicious packages via OpenSSF data
Dependabot alerts now ingest malware advisories from the OpenSSF malicious-packages repository, expanding coverage across ecosystems such as npm and PyPI. Users can view these advisories using the type:malware filter.
Enhancements (1) ›
- Automatic malware alerting with expanded ecosystem coverage
With malware alerting enabled, Dependabot will automatically match dependencies against the expanded set of malware advisories. New advisories from the OpenSSF data source will trigger alerts as they are published, without requiring additional configuration.
Notes (1) ›
- How to enable malware alerting for Dependabot
Users who have not yet enabled malware alerting can navigate to repository or organization Settings > Code security > Dependabot and enable Malware alerts. Malware advisories can also be browsed directly at github.com/advisories.
https://github.blog/changelog/2026-07-28-dependabot-alerts-on-malicious-packages-across-more-ecosystems
Related releases
- GitHub Copilot usage metrics now include VS Code Agents activity GitHub Changelog ·
- GitHub Copilot Code Review Gains Auto-Resolution, Smart Commits, and Deeper Analysis GitHub Changelog ·
- GitHub Copilot Weekly Releases: Jira Integration, HydraFusion, and Enterprise Controls GitHub Changelog ·
- GitHub Launches Refreshed Repository Pull Requests Page in Public Preview GitHub Changelog ·
- GitHub AI Scan for PRs: API Management Now in Public Preview GitHub Changelog ·
- Control GitHub Actions Cache Access with cache-mode GitHub Changelog ·