GitHub Expands Supply Chain Malware Detection From npm to 8 Package Registries
Brief
GitHub has expanded its malware detection capabilities beyond npm, providing developers with broader protection against malicious open-source packages.
Dependabot alerts can now identify harmful dependencies across 8 major package ecosystems: npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer.
A malicious package can steal passwords , API keys, cloud credentials, cryptocurrency wallets, and source code immediately after installation.
Attackers often use typosquatting, dependency confusion, compromised maintainer accounts, or malicious prebuilt binaries to insert these packages into trusted development workflows.
Earlier in 2026, GitHub introduced malware alerts for npm dependencies. The latest expansion adds PyPI support and extends coverage to other major ecosystems, drawing on data from the Open Software Security Foundation (OpenSSF).