GitHub Dependabot malware alerts now cover npm, PyPI and more: how to turn them on (2026)

GitHub Dependabot malware alerts now cover npm, PyPI and more: how to turn them on (2026) Summary. On 28 July 2026 GitHub started ingesting malware advisories from the OpenSSF malicious-packages proje