A malware advisory has no fixed version: what do you do?

A malware advisory has no fixed version because the package is the problem, not a bug in it. GitHub says the only safe action is to stop using the package and find a replacement. Remove it, search every place it may have been installed, and rotate credentials if it ran in any environment holding secrets.

Why there is no fix

GitHub's advisory database has three kinds of advisory. Reviewed advisories are vulnerability records mapped to supported ecosystems and checked for validity. Unreviewed ones come automatically from the NVD feed and are not checked. Malware advisories describe malicious packages and are published automatically from the npm security team and the OpenSSF Malicious Packages repository. GitHub notes they have no fix version.

In OSV, the same data carries the MAL prefix, which the OSV schema assigns to the Malicious Packages repository. So an ID starting with MAL means a malicious package report, not a vulnerability.

A response sequence

1. Confirm the match. Check ecosystem, package name and version against your lockfile or SBOM. Names can be near-matches.
2. Remove and block. Delete the dependency, and block the name in your registry proxy or policy so it cannot return.
3. Search wide. Check all repositories, build caches, container images and developer machines for the package. An SBOM inventory makes this a query rather than a hunt.
4. Establish whether it ran. Look at CI logs and install history. Install scripts can run at install time, not only at import.
5. Rotate secrets that were reachable from any place it ran, in order of impact. Our post on rotating secrets after a malicious package ran in CI gives the order.
6. Look for signs of activity such as unexpected outbound connections or new accounts. See what to do after installing a malicious package.
7. Record the decision with dates, so you can show what you did and when.

Common mistakes

• Treating it like a CVE and waiting for a patch.
• Deleting the package but leaving old container images that include it.
• Assuming a private mirror protects you. See whether a private mirror stops malicious versions.
• Forgetting developer laptops.

How to tell the data apart in your tool

Ask your scanner whether it shows malware findings separately from vulnerabilities. If both appear in one severity-ranked list, malware may end up under "medium" simply because no score applies. A good rule: any confirmed malware match is handled as an incident, whatever the score.

Where Safeguard fits

Safeguard provides SBOM and dependency scanning and policies that can block a dependency. An up to date inventory is what makes steps 1 and 3 quick. You can see an inventory for your own project with the free scan at gold.safeguard.sh/scan.

Try it yourself

Click through it at your own pace, or open it full screen.

Look at how you can find every place a package appears.

Quick check

Sources

• GitHub Docs, About the GitHub Advisory Database, fetched 19 October 2026.
• OSV schema, ID prefixes, fetched 19 October 2026.

Last reviewed: 19 October 2026.