How we took malware advisories beyond npm

GitHub's Dependabot now flags malware across eight package ecosystems, including PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer, by importing OpenSSF's malicious-packages data. The pipeline auto-publishes advisories, skips round-trip reports, and includes batch caps, provenance, and rollback protections.