are we certain that we want to customize it to Malware in <package name>?
It would mean that we would replace the vulnerabilities title, which is displayed by default. And the context should already show that we are dealing with a malicious package. Given that, we just wanted to double-check this requirement.
@dpisek @nilieskou @joelpatterson I wasn't the one who proposed replacing the vuln title with Malware in <package name>, but I have a question (not sure who for, but putting it out there): Does the "what kind of malware" context change the user's immediate action? If the answer is almost always "remove the package" regardless of malware type, then this generic title is fine — the detail page is where you learn more. But if a security engineer is triaging 15 malware findings and needs to prioritize, knowing "backdoor with C2 communication" vs. "typosquat with no known payload" matters, and the title is the first (sometimes only) thing they read in a list.
A middle ground could be to include both — e.g.: Malware in <package name>: <brief descriptor> — but that gets long and may get truncated to Malware in <package name> anyway, at least in the current Vuln Report view. Our vision designs are moving the UI away from columns so we will have more horizontal space for titles, and badges will show corresponding risk that supports the severity, e.g.:
I asked Claude to give me an example of a title of a malware vulnerability if we DON'T replace it with the Malware in <package name> , and the response suggests that either way, malware will be in the title, but that using Malware in <package name> is the way to go - as long as we provide add'l context elsewhere.
Looking at actual GLAD advisory titles, there are basically two patterns already in use:
Pattern 1 — Generic: Malware in simple-swizzle, Malware in strip-ansi
Pattern 2 — Descriptive: package-tester contains malware after npm account takeover, @browserbasehq/stagehand contains malware after npm account takeover
So if you don't replace the title, a user might see something like package-tester contains malware after npm account takeover — which actually tells you something useful (it was a supply chain attack via account takeover, not a typosquat or a rogue dependency).
But here's the thing: the descriptive titles aren't consistent. Some advisories just say Malware in <package> with no additional context in the title at all. So if you pass through the GLAD title as-is, you'd get a mix of both patterns in the vulnerability report, which looks messy and inconsistent.
That actually makes a stronger case for normalizing to Malware in <package name>. The descriptive context ("account takeover," "exfiltrates .env files," "typosquat") is genuinely valuable, but it's not reliably present in the title field across advisories. It lives more consistently in the description/body of the advisory.
So I'd land here: use Malware in <package name> as the title for consistency, but make sure the descriptive context from the advisory body surfaces somewhere accessible without a click — whether that's in the Evidence section, a subtitle in list view, or the description preview. That way you're not losing the "what kind" context; you're just moving it to a place where it can be reliably populated rather than depending on inconsistent upstream title formatting.
cc @marissa.henri @mclausen35
