Ankit Kumar Honey

How we took malware advisories beyond npm

GitHub malware advisories no longer stop at npm. Here’s how we wired OpenSSF’s malicious-packages data into the Advisory Database, and why we built the pipeline paranoid.

AKAnkit Kumar Honey·August 6, 2026Security