GitHub has expanded its Dependabot malware alerts beyond npm, enabling the detection of malicious dependencies across various package ecosystems, including PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. This rollout is supported by a new GitHub Advisory Database importer for OpenSSF’s malicious-packages repository, which enhances supply chain detection across these eight ecosystems. GitHub Expands […]

The post GitHub Expands Dependabot Malware Alerts to Detect Malicious Packages Across 8 Ecosystems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Attackers have been observed abusing GitHub Actions workflows to distribute provenance-signed malicious npm packages, marking a significant escalation in software supply chain threats. On July 14, 2026, Microsoft Threat Intelligence uncovered a coordinated compromise of the widely used @asyncapi npm organization, where adversaries leveraged trusted CI/CD pipelines to publish backdoored packages with valid cryptographic provenance. […]

The post Attackers Abuse GitHub Actions Workflow to Publish Provenance-Signed npm Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.