How we took malware advisories beyond npm

Ankit is a Senior Engineering Manager at GitHub, where he leads the Dependabot team in the Supply Chain Security organization.

What happened

Ankit is a Senior Engineering Manager at GitHub, where he leads the Dependabot team in the Supply Chain Security organization. Dependabot watches over 30M+ repositories across 34+ package ecosystems, which keeps him appropriately paranoid about supply chain attacks.

Practical impact for readers

The GitHub Advisory Database is processing more vulnerability reports than ever before. Here’s what’s driving the surge, how we’re responding, and how the community can help.

Details worth verifying

GitHub Actions gives teams access to powerful, native CI/CD capabilities right next to their code hosted in GitHub. Starting today, GitHub will send a Dependabot alert for vulnerable GitHub Actions, making it even easier to stay up to date and fix security vulnerabilities in your actions workflows.

Who should act or wait

Dependabot keeps your dependencies current, but its defaults can flood your repository with pull requests. Here’s how grouping updates, slowing the cadence, and keeping security fixes fast cut the noise on a Microsoft open source project.

What is still unclear

Explore the changes we’ve shipped across npm and GitHub Actions over the past few months to disrupt supply chain attack techniques and limit their impact.

Source notes

GitHub Blog