PushMe

Live Event Page

Dependabot now detects malware in npm dependencies

You can now receive Dependabot alerts when your repositories depend on npm packages with known malicious versions. When you enable malware alerting, Dependabot matches your npm ...

Early report Major update Updated Mar 17, 2026, 9:51 PM UTC

What changed

GitHub Changelog: Dependabot now detects malware in npm dependencies.

First seen Mar 17, 2026, 9:51 PM UTC Latest source Mar 17, 2026, 9:51 PM UTC