{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/github-repository-organization-and-enterprise-levels/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GitHub (Repository, Organization, and Enterprise levels)"],"_cs_severities":["medium"],"_cs_tags":["cloud","saas","github","defense-evasion"],"_cs_type":"advisory","_cs_vendors":["GitHub"],"content_html":"\u003cp\u003eGitHub audit logs capture events where Dependabot alerts or automated security updates are disabled. This activity is a potential indicator of defense evasion, as it prevents GitHub from flagging malicious or vulnerable packages. Depending on the scope of the configuration change, an actor can remove automated security coverage from a single repository, an entire organization, or an enterprise environment. This often precedes the injection of malicious code or dependency tampering.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eDisabling Dependabot removes automated visibility into vulnerable and malicious packages, increasing the likelihood that supply-chain compromises go undetected by security tooling.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor GitHub audit logs for the specific \u003ccode\u003edisable\u003c/code\u003e actions listed in the detection guidance below.\u003c/li\u003e\n\u003cli\u003eAudit administrative access and programmatic tokens that have permissions to modify organization or enterprise security settings.\u003c/li\u003e\n\u003cli\u003eReview repository commits and dependency manifest changes (e.g., package.json, go.mod, requirements.txt) occurring immediately before or after these disable events.\u003c/li\u003e\n\u003cli\u003eRe-enable Dependabot features unless a documented and approved exception exists.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-02T15:08:50Z","date_published":"2026-11-02T15:08:50Z","id":"https://feed.craftedsignal.io/briefs/2026-11-github-dependabot-disable/","summary":"Adversaries may disable GitHub Dependabot alerts or security updates at the repository, organization, or enterprise level to conceal the introduction of malicious or vulnerable dependencies.","title":"GitHub: Disabling Dependabot alerts and security updates","url":"https://feed.craftedsignal.io/briefs/2026-11-github-dependabot-disable/"}],"language":"en","title":"CraftedSignal Threat Feed - GitHub (Repository, Organization, and Enterprise Levels)","version":"https://jsonfeed.org/version/1.1"}