The GitHub Advisory Database is GitHub’s central catalog of security advisories, including known vulnerabilities and malicious package reports. It feeds tools such as Dependabot, which use the database to warn developers when a dependency matches a known risk.
Its security value is in turning threat intelligence into actionable alerts inside the normal development workflow. For conventional vulnerabilities, an advisory may point to a fixed version. For a malicious package, the safer response is often removal or replacement, because there may be no trustworthy upgrade path. That makes the database especially useful for supply-chain defense across package ecosystems such as npm, PyPI, Maven, and others.
In attacks, adversaries exploit typosquatting, dependency confusion, or compromised maintainer accounts to publish harmful packages. In defense, advisory ingestion helps security teams spot those packages early, but they still need to check namespace, registry, and internal package collisions to avoid false positives.