GitHub Advisory Database: reviewed, unreviewed and malware advisories

The GitHub Advisory Database holds three advisory types. Reviewed advisories are checked by GitHub and trigger Dependabot alerts. Unreviewed ones are imported automatically from the NVD feed and do not trigger alerts. Malware advisories cover intentionally harmful packages and have no fix version, so the safe action is to stop using the package.

Reviewed advisories

GitHub's documentation says reviewed advisories are checked for validity and confirmed to include a full description plus ecosystem and package information. They list affected version ranges and the earliest fixed version. Dependabot creates alerts for them.

Sources for reviewed advisories include GitHub-reported security advisories, the NVD, ecosystem databases such as those for npm, Go, Python, Ruby and Rust, and community pull requests.

Unreviewed advisories

These are published automatically from the National Vulnerability Database feed. GitHub does not check them for validity or completeness, and Dependabot does not create alerts for them. If you rely on alerts alone, a vulnerability that sits only in this category will not reach you through Dependabot.

Malware advisories

Malware advisories describe packages that are harmful on purpose. They come from the npm security team and the OpenSSF Malicious Packages repository. There is no fixed version to upgrade to, so the action is removal. Most involve substitution attacks, in which a malicious public package takes the name of a private or third party dependency.

IDs and formats

Every advisory has a GHSA ID, whatever its type. Advisories imported from the NVD link to the matching CVE record, which holds the detailed description and CVSS scores. When GitHub obtains a CVE for an advisory, it uses the CVSS version the maintainer assigned, 3.1 or 4.0. Advisories are published in the OSV format. Our comparison covers how the identifiers relate: GHSA, CVE and OSV formats.

What to do with this

• Do not treat the absence of a Dependabot alert as proof of no known vulnerabilities. Unreviewed entries are outside it.
• Treat a malware advisory as an incident, not a patch task. Check where the package was installed, rotate any secrets that build or runtime environments could reach, and rebuild.
• When you read a reviewed advisory, look at the affected range and the first fixed version. How to read a GitHub security advisory walks through it.

Safeguard's SBOM and dependency scanning give you an inventory of what you ship, so you can check it against advisories directly instead of waiting for an alert.

Quick check

Sources

• GitHub: about the GitHub Advisory Database

Last reviewed: 19 October 2026.