How we took malware advisories beyond npm
GitHub malware advisories no longer stop at npm. Here’s how we wired OpenSSF’s malicious-packages data into the Advisory Database, and why we built the pipeline paranoid.
Ankit Kumar Honey
Ankit is a Senior Engineering Manager at GitHub, where he leads the Dependabot team in the Supply Chain Security organization. Dependabot watches over 30M+ repositories across 34+ package ecosystems, which keeps him appropriately paranoid about supply chain attacks.
Posts by this author