Malware detection expands beyond npm

A malicious package can compromise your environment the instant it's installed. Until recently, GitHub could only warn you about those threats in the npm ecosystem. That's changed: the GitHub Advisory Database now ingests malware reports from OpenSSF's malicious-packages repository, and Dependabot alerts now cover all eight major package ecosystems: npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer.

The supply chain engineering team behind Dependabot built this on a simple premise: rather than constructing eight new detection pipelines, reuse the aggregation work OpenSSF has already done.

One importer instead of eight detectors

The Advisory Database has long imported vulnerability data from external, ecosystem-specific sources—RubySec for RubyGems, RustSec for crates.io, PyPA for Python. Malware was the exception, flowing through a separate, internal pipeline that only handled npm packages and relied on GitHub's own detection.

Scaling that bespoke npm path to every ecosystem would have been a multi-year project. OpenSSF's repository, launched in 2023, already contains over 15,000 malware reports in OSV format, growing daily with contributions from community submissions and automated detection across the industry—typosquats, dependency-confusion packages, account takeovers, and malicious prebuilt binaries. It's public, structured, and format-agnostic about ecosystems.

The resulting design is a single importer that walks the source repository's file tree, picks up files changed since the last run, and validates each OSV record against the schema before anything reaches the database. Records that fail validation are rejected and logged—never silently repaired—because a "mostly valid" malware advisory is a liability waiting to surface months later.

Normalizing messy data

The importer's job gets interesting when upstream data doesn't line up with internal conventions. Ecosystem strings differ (PyPI upstream versus pip in the database), OSV records list affected versions as discrete values where GitHub thinks in ranges, and some records name no usable version at all. Details fields are frequently empty, and multiple reports on the same package get concatenated into a single blob.

Retractions add another layer of complexity. The repository maintains an osv/withdrawn folder for advisories that turned out to be false, so the importer must handle a package flagged one day and disavowed the next.

Deduplication presented a unique challenge: GitHub itself contributes to the OpenSSF repo, with its own npm malware advisories flowing upstream. A naive import would re-ingest that data in an endless loop. The solution leverages OSV's origin metadata—entries tagged ghsa-malware originated with GitHub and are dropped before creating feed entries. During validation against live data, more than half of the new npm reports arriving monthly traced back to GitHub's own advisories and were skipped as round-trips, meaning the importer captures genuinely novel threats.

Engineering for upstream failure

The security review centered on a single question: what happens if the upstream data goes bad?

Malware advisories auto-publish without human review by design. When a package is actively stealing credentials, a review queue measured in days benefits the attacker. However, this is the first time an auto-published advisory can trigger a Dependabot alert, a deliberate departure from the reviewed-advisory pipeline where human curators verify package mappings, version ranges, and severity before publication.

That rigor makes sense for vulnerability advisories, where the question is which versions of a library are affected. Malware is closer to binary—the package is hostile—and hours matter more than nuance. The design assumes the upstream feed could carry bad data: a false report flagging a legitimate package, a record with an incorrect package name, or a compromised source publishing malicious batches.

Three protective layers address that scenario:

  1. Batch caps. Each import run has a configurable ceiling on how many advisories it may create. Exceeding the cap halts the run entirely—no partial publishing, no trimming to fit—and pages the team with the exact count. A run requesting five times the usual volume isn't throughput; it's a signal.
  2. Provenance tracking. Every imported advisory traces back to the exact upstream commit in the malicious-packages repo, enabling rapid incident response to determine whether a bad advisory came from a legitimate-but-wrong report or something more deliberate.
  3. Rollback capability. Each batch is identifiable and revertible as a unit, avoiding the need to hand-pick individual advisories out of the database after a compromised batch lands.

Enabling malware alerts

Dependabot now matches dependencies against malware advisories across most package ecosystems. Alerts are opt-in and can be enabled per repository, organization, or enterprise in security settings. Once activated, Dependabot runs a backfill against existing advisories, so protection begins immediately.