GitHub Expands Supply Chain Malware Detection From npm to 8 Package Registries

GitHub has expanded its malware detection capabilities beyond npm, providing developers with broader protection against malicious open-source packages. Dependabot alerts can now identify harmful dependencies across 8 major package ecosystems: npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. A malicious package can steal passwords, API keys, cloud credentials, cryptocurrency wallets, and source code immediately after installation. Attackers often use typosquatting, dependency confusion, compromised maintainer accounts, or malicious prebuilt binaries to insert these packages into trusted development workflows. Earlier in 2026, GitHub introduced malware alerts for npm dependencies. The latest expansion adds PyPI...

Read the full article at the source.