How we took malware advisories beyond npm

GitHub Security Blog RSS items covering software supply-chain security, malicious package advisories beyond npm, npm and GitHub Actions attack disruption, Dependabot update management and cooldowns, repository ownership, secret scanning remediation and false-positive reduction, vulnerability advisory operations, maintainer security settings, and bug bounty program changes. The material is primarily defensive guidance and platform security operations rather than a report of a specific exploitable vulnerability.