GitHub: Disabling Dependabot alerts and security updates

GitHub audit logs capture events where Dependabot alerts or automated security updates are disabled. This activity is a potential indicator of defense evasion, as it prevents GitHub from flagging malicious or vulnerable packages. Depending on the scope of the configuration change, an actor can remove automated security coverage from a single repository, an entire organization, or an enterprise environment. This often precedes the injection of malicious code or dependency tampering.

Impact

Disabling Dependabot removes automated visibility into vulnerable and malicious packages, increasing the likelihood that supply-chain compromises go undetected by security tooling.

Recommendation

• Monitor GitHub audit logs for the specific disable actions listed in the detection guidance below.
• Audit administrative access and programmatic tokens that have permissions to modify organization or enterprise security settings.
• Review repository commits and dependency manifest changes (e.g., package.json, go.mod, requirements.txt) occurring immediately before or after these disable events.
• Re-enable Dependabot features unless a documented and approved exception exists.