Malicious code hiding in your dependencies just got harder to hide, no matter which language you write in.
GitHub has expanded its Dependabot malware advisories from npm alone to eight ecosystems total: npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. The company built a single importer that pulls structured reports from OpenSSF's malicious-packages repository, a public database of more than 15,000 entries covering typosquats, dependency-confusion attacks, and hijacked accounts. Because GitHub's own npm advisories already feed into that OpenSSF repo, the importer has to filter out its own reports to avoid re-ingesting them in a loop. GitHub says more than half of the new npm entries each month turn out to be exactly that kind of round-trip.
This closes a gap that mattered: a Python or Java developer had zero automated warning if a dependency turned out to be stealing credentials, while npm users got flagged the same day. Malware advisories publish automatically without human review, on the logic that hours matter more than nuance when a package is actively exfiltrating data right now.
That speed is also the risk: GitHub is betting three layers of batch caps, provenance tracking, and one-click rollback are enough to catch a bad automated report before it pages the wrong developer.