OpenSSF said on 16 October that GitHub has added OpenSSF's malicious-packages data to its Advisory Database. Before this, GitHub's malware advisories mainly covered npm. They now also cover PyPI, Maven, RubyGems, NuGet, Go, crates.io and PHP Composer. OpenSSF says its database began in October 2023 and holds more than 238,000 reports. More than 28,000 of them list GitHub as a source. Ankit Kumar Honey, who leads the Dependabot team at GitHub, said building this detection alone would have taken years, according to OpenSSF.
OpenSSF says GitHub built an importer that checks reports, cleans up records and skips advisories that were withdrawn. It also avoids re-importing GitHub's own reports. Limits on batch size, links back to upstream commits and a rollback option are listed as safeguards. The post gives no date for when the wider coverage went live. It does not say how many of the 238,000 reports became GitHub advisories. It also gives no detection or false-alarm rates.
For teams that build or run software, this extends malware warnings beyond npm projects. Alerts are off by default and need Dependabot alerts switched on first. OpenSSF says teams with internal packages named like a malicious public one can cut false alarms with auto-triage rules. Reports can also be browsed in the GitHub Advisory Database with the type:malware filter.