Loading story…
GitHub has expanded its malware advisory pipeline and Dependabot malware alerts beyond npm to cover eight major package ecosystems by ingesting malicious package data from OpenSSF’s malicious-packages repository into the GitHub Advisory Database. The broader coverage now includes npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer, allowing repositories, organizations, and enterprises that opt in to receive alerts when malicious dependencies are detected in current packages or through advisory backfill.
To support the expansion, GitHub built a single importer that validates OSV records, normalizes ecosystem and version data, handles withdrawn advisories, and prevents circular re-import of GitHub-originated malware advisories tagged ghsa-malware. Because these malware advisories are auto-published without manual review to speed response times, GitHub added safeguards including batch caps, provenance tracking to upstream commits, and batch-level rollback to reduce the risk of bad or compromised upstream data triggering incorrect alerts.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
GitHub started flagging malware in npm dependencies before the broader ecosystem expansion. One reference explicitly anchors this npm-only malware coverage to March 2026.
The OpenSSF malicious-packages repository launched in 2023 as a public OSV-format feed for malicious package reports. The repository has since been used to collect community and automated reports across multiple package ecosystems.
GitHub expanded Dependabot malware advisories from npm-only coverage to eight major package ecosystems by ingesting OpenSSF malicious package data into the GitHub Advisory Database. The added coverage includes PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer alongside npm.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcegithub.blog
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitHub rolled out new supply-chain protections across **GitHub Actions** and **npm** to curb attacks that abuse CI/CD workflows and malicious package publishing. On public repositories hosted on GitHub.com, workflow runs that GitHub flags as suspicious are now automatically paused until a repository collaborator with write access approves them through an authenticated web session. The safeguard is enabled by default and is aimed at attacks involving compromised GitHub credentials, malicious workflow files, and workflow-based secret theft or package tampering, though GitHub has not disclosed detection logic and said the control does not guarantee every malicious run will be caught. GitHub also introduced **publish-time malware scanning** for npm packages, shifting enforcement from scanning after publication to gating releases before they become available. Under the new process, a package can be published, held for review, or blocked based on scan results, alongside new dual-use metadata requirements such as `contentPolicy` and `DISCLOSURE`. The changes build on GitHub’s broader response to open-source supply-chain attacks, including guidance to pin third-party Actions to full commit SHAs, avoid unsafe `pull_request_target` usage, use **OpenID Connect** for secretless authentication, and rely on trusted publishing across ecosystems including **npm**, **PyPI**, **NuGet**, **RubyGems**, and **Crates**.
Jul 31, 2026
GitHub has changed Dependabot to wait three days before opening pull requests for non-security version updates, aiming to keep fast-moving malicious package releases out of automated developer workflows. The company said the change was driven by repeated software supply-chain incidents in which poisoned npm releases were detected and removed within hours, but still had enough time to be pulled into builds. GitHub pointed to a 2025 npm compromise in which an attacker phished a maintainer and published malicious versions of widely used packages including **`chalk`** and **`debug`**, with code that rewrote cryptocurrency wallet addresses before the packages were taken down roughly two hours later. Security updates tied to known advisories are not delayed and will still be issued immediately. The move aligns with broader industry guidance that the first hours after a package is published are the highest-risk period for dependency consumers. Research cited similar attacks affecting 18 npm packages with more than 2.6 billion weekly downloads and the **Nx** build attack, which remained live for about four hours, reinforcing recommendations to delay automated updates by 24 to 48 hours or longer. GitHub said the npm ecosystem logged more than 6,500 malware advisories in the year ending May 2026 and urged teams to combine cooldowns with other controls, including lockfiles, careful review before merge, scoped CI tokens, disabling install scripts where possible, and pinning dependency versions to reduce supply-chain exposure.
Jul 29, 2026
GitHub disabled more than 70 Microsoft-owned repositories after detecting a suspected **Miasma** worm campaign that inserted malicious code into open source projects and disrupted dependent CI/CD workflows. Researchers said the incident began with a compromised contributor account pushing a malicious commit to `Azure/durabletask`, adding configuration files that could trigger remote code execution when developers opened the repository in IDEs or AI coding tools including **Claude Code**, **Gemini CLI**, and **Cursor**. Microsoft’s response was unusual because it shut down its own repositories rather than only removing the offending content, and GitHub reportedly disabled 73 repositories in rapid succession after automated detections fired. The activity appears tied to a broader supply-chain operation linked to earlier compromises of Microsoft’s `durabletask` PyPI package and to a newer campaign tracked by StepSecurity as **Hades**, which it describes as an evolution of Miasma. StepSecurity said the malware uses obfuscated Python import hooks to fetch additional payloads, scrape memory across Linux, macOS, and Windows, steal cloud and developer credentials, abuse GitHub Actions and OIDC/Sigstore workflows, move laterally over SSH/SCP, and backdoor IDE and AI assistant configuration files. The campaign also reportedly uses GitHub-based command-and-control and includes a token-monitoring component that can trigger a destructive wiper if a stolen GitHub token is revoked, underscoring the risk to software supply chains and AI-assisted development environments.
Jun 29, 2026