Dependabot detection of Malware packages [GA]

### Value Prop

Dependabot malware alerts help you proactively identify when your repositories pull in known malicious package versions (starting with npm and expanding as coverage grows), so you’re not relying on manual threat intel gathering or piecing together signals across multiple tools. By surfacing targeted supply-chain malware risk directly where you manage dependencies, teams can quickly understand exposure and take action before a malicious package spreads further in their environments.

### Expected Outcome

With malware alerts, customers can expect faster detection and response to malicious dependency incidents across large repo portfolios, with clearer notification and prioritization of the highest-risk packages. This reduces time spent on investigation, lowers the likelihood of shipping compromised code, and strengthens overall software supply chain trust without requiring additional tooling or custom monitoring.

The issue names no repository files, tests, or entry points, so start by locating the Dependabot malware-alert implementation and its existing notification and prioritization flows. Done means detecting known malicious package versions, initially for npm, and surfacing actionable alerts across repository portfolios as described in the expected outcome.

由索引模型根据 Issue 内容生成。