GitHub expands malware alerts from npm to eight package ecosystems
GitHub’s supply‑chain team integrated OpenSSF’s malicious‑packages data into the Advisory Database, letting Dependabot flag malware across npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. The unified importer validates OSV records, rejects bad data, and powers alerts that protect any ecosystem the OSV schema supports.