# GitHub Dependabot alerts on malicious packages across more ecosystems

- Product: GitHub (https://whatsnew.fyi/product/github)
- Vendor: GitHub
- Date: 2026-07-28
- Original notes: https://github.blog/changelog/2026-07-28-dependabot-alerts-on-malicious-packages-across-more-ecosystems
- Permalink: https://whatsnew.fyi/product/github/releases/2026-07-28-dependabot-alerts-on-malicious-packages-across-mo

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

The GitHub Advisory Database now ingests malware advisories from the OpenSSF malicious-packages repository, significantly expanding the breadth of malware data available to you through Dependabot aler…

- **added** — Dependabot alerts now include malware advisories from the OpenSSF malicious-packages repository across more ecosystems