dependabot-malware-detection

Dependabot malware detection in open source packages

Dependabot catches known vulnerabilities, not injected malware. Here's how GitHub Advanced Security handles malicious packages — and where the gaps remain.