GitHub warns of malware packages across eight ecosystems

More than 238,000 reports on malicious packages are now held in a public database maintained by the Open Source Security Foundation (OpenSSF). The malicious-packages repository started in 2023 with more than 15,000 entries. It is maintained by a community and uses the OSV format, the Open Source Vulnerability format, which is a uniform description of known security vulnerabilities and malware in software packages. In late July, GitHub announced that it would import this data into its own Advisory Database.

Until now, GitHub's malware warnings covered only packages in the npm ecosystem, that is, JavaScript libraries. Since the announcement, the company has covered eight package ecosystems: crates.io (Rust), Go, Maven, NuGet, npm, PHP Composer, PyPI (Python) and RubyGems. According to Ankit Kumar Honey, Senior Engineering Manager at GitHub and head of the Dependabot team, building its own detection methods for all of these languages would have taken years. GitHub therefore turned to an existing source. Honey put it this way: “Meanwhile, OpenSSF has already solved the aggregation problem for everyone.”

For the import, GitHub built its own tool. It checks the reports, standardizes the datasets and handles withdrawn advisories. It also prevents duplicate imports of GitHub's own contributions. As safeguards, GitHub cites caps on import batches, traceability back to the upstream commits, and the ability to roll back entire batches.

For development teams, this means that anyone using Dependabot, GitHub's service for monitoring a project's dependencies, can receive warnings about malicious packages. These warnings are opt-in, meaning they are voluntary, and must additionally be enabled in each repository. Organizations and enterprises can roll them out collectively via Security Configurations. Anyone who has already enabled malware warnings receives the expanded coverage automatically. In addition, the reports can be found in the Advisory Database using the filter type:malware.

There are two limitations. If an internal package shares its name with a malicious public package, false alarms can occur. These can be reduced with auto-triage rules for Dependabot. Caution is required here: the prebuilt rule “Dismiss package malware alerts” is disabled by default, but it also dismisses warnings about dependencies that are genuinely malicious in all versions. The figures come from the OpenSSF and GitHub themselves; the documents contain no independent measurements of how many malicious packages the database captures.