Malware findings now documented as GitHub advisories
Not every flaw in open source is accidental. Malicious code is sometimes deliberately planted in packages, but documenting those cases has always been awkward: malware is typically removed quickly, and it doesn't qualify for the standard CVE disclosure process that feeds the National Vulnerability Database (NVD). That leaves a gap in the public record.
GitHub says it detects malware through a combination of automated scanning, security research, and community reports. As of today, once a malicious package is taken down, GitHub will also publish an advisory describing the malware in the GitHub Advisory Database.
Dependabot coverage extends to malicious packages
These malware advisories already feed Dependabot alerts, so anyone currently using Dependabot gets protection without changing a setting. Users who haven't enabled alerts can do so by turning on "enable all" under the "Code security and analysis" tab in their account settings.
Advisory data stays open and free
The GitHub Advisory Database powers the platform's supply chain security features, including Dependabot alerts and security updates. The database has carried a Creative Commons license from the start, so the data remains freely available to the community. Documentation on managing vulnerable dependencies and the full advisory database are both publicly accessible for anyone wanting to dig deeper.
