Add GH malware advisories

[pombredanne]

See https://github.com/advisories?query=type%3Amalware
They need special treatment because the packages have been retired/yanked from the registries.