GitHub has expanded Dependabot’s malware-detection capabilities beyond npm, enabling alerts for malicious dependencies across eight major package ecosystems. The update extends coverage to PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer, using OpenSSF’s shared malicious-packages repository as a new threat-intelligence source. Earlier in 2026, GitHub introduced Dependabot malware alerts for npm dependencies. The latest […]
The post GitHub Expands Dependabot Malware Alerts Beyond npm to Eight Package Ecosystems appeared first on Cyber Security News.