GitHub npm package firewall can block new versions before install
Enterprises can set a cooldown, alongside AI Scan, Copilot checks, and Dependabot reachability ranking.
38
Product
Dependabot
- Mentions · 7d1
- Mentions · 30d3
- All mentions6
- First seenSep 3, 2026
- Last mentioned2d ago
Timeline
6 articles · newest first12 Best SCA Tools Compared (2026): Features & Pricing
A 2026 SCA comparison highlights Snyk, Sonatype, and Socket across three dependency-risk lanes.
15
Top 10 Best SCA Tools in 2026 [Ranked & Scored]
A 2026 ranking of ten SCA tools places Snyk first, then Sonatype and Endor Labs.
20
KEVGraph: Exploitation-Aware Dependency Vulnerability Remediation
KEVGraph orders dependency upgrades so CISA KEV fixes precede higher-CVSS vulnerabilities.
58
VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities
Introduces VEX-Bench, 75 expert-labeled real-world cases testing whether LLM agents can assess supply chain vulnerability exploitability; frontier models reach about 80% F1.
42
Your threat feed is someone else's database: What ingesting malware intel at scale takes
GitHub's Dependabot lead shares five production lessons for ingesting community malware intelligence feeds across eight package ecosystems at scale.
28
Appears with
- GitHubvendor · 4
- npmproduct · 3
- JFrog Xrayproduct · 2
- Snykvendor · 2
- Mendvendor · 2
- Socketvendor · 2
- Sonatypevendor · 2
- JFrogvendor · 2
- Snykproduct · 2
- Black Duckvendor · 2
- Endor Labsvendor · 2
- OWASPorganization · 1
- OpenAIvendor · 1
- OWASP Dependency-Checkproduct · 1
- Xygenivendor · 1
- Mavenproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.