GitHub Expands Dependabot Malware Alerts Beyond npm to Eight Package Ecosystems
Brief
GitHub has expanded Dependabot’s malware-detection capabilities beyond npm, enabling alerts for malicious dependencies across eight major package ecosystems.
The update extends coverage to PyPI, Maven, RubyGems, NuGet, Go, crates. io, and PHP Composer, using OpenSSF’s shared malicious-packages repository as a new threat-intelligence source. Earlier in 2026, GitHub introduced Dependabot malware alerts for npm dependencies.
The latest expansion significantly broadens the protection available to development teams, especially organizations operating polyglot environments where JavaScript, Python, Java, Ruby, .NET, Go, Rust, and PHP packages coexist.
GitHub Expands Dependabot Malware Alerts
GitHub enhanced its Advisory Database to ingest malware reports from OpenSSF’s malicious-packages repository.