A malware advisory is a security record that labels a software package as malicious, not just vulnerable. Unlike a CVE-style warning, it does not imply there is a fixable bug in the code; it means the package itself should be treated as unsafe and removed from the dependency tree. In supply-chain security, that distinction matters because the right response is replacement or deletion, not a version upgrade.
Malware advisories appear in package registries and dependency tools when threat intelligence identifies harmful packages through signals such as typosquatting, dependency confusion, compromised maintainer accounts, or abusive publishing. Defenders use these advisories to block installs, alert maintainers, and stop builds before malicious code reaches production. They are especially useful across large ecosystems where trusted-looking packages can enter projects through automated dependency resolution.