Advisories are not spread evenly. In OSV exports from 19 October 2026, 75.4 percent of npm packages with an advisory have exactly one, while PyPI and Go have a heavier middle, with only 22.8 and 19.6 percent at one. The top ten packages carry between 10.8 and 31.1 percent of all advisory links.
Method
We downloaded eight OSV exports on 19 October 2026 and kept vulnerability advisories (excluding MAL- and withdrawn records). We counted, for each package name, how many advisories list it. An advisory that lists several package names counts once for each. Shares of the top ten are of these package links, not of distinct advisories.
Limits: several package names can be one product (see below), so "package" here means a registry name, not a project.
What the numbers say
| Ecosystem | Packages with advisories | Exactly one advisory | Top ten share of links | Largest single count |
|---|---|---|---|---|
| npm | 3,830 | 75.4% | 16.4% | 590 |
| RubyGems | 500 | 65.2% | 23.0% | 62 |
| crates.io | 1,812 | 62.6% | 10.8% | 102 |
| Maven | 3,410 | 61.0% | 12.6% | 259 |
| Packagist | 1,523 | 60.4% | 24.9% | 437 |
| NuGet | 735 | 53.6% | 31.1% | 247 |
| PyPI | 1,944 | 22.8% | 27.5% | 861 |
| Go | 1,705 | 19.6% | 18.7% | 479 |
The heavy hitters are mostly applications and platforms, not small libraries. In Maven the top entry is the core package of a CI server (259). In Packagist it is a learning platform (437), and a commerce platform and a content system follow. In Go the leaders are a team chat server, a note-taking app and a Git hosting service. Large products accumulate advisories because they have many features and many researchers.
Same product, many names
Counting by name hides a pattern. In PyPI, three package names for one machine learning library (the main one, a GPU build and a CPU build) carry 861, 848 and 847 advisories, and these are largely the same advisories listed against three names. In NuGet, 41.2 percent of advisories list more than one package name, which fits one imaging library published in many build variants. In Go, 17.0 percent do, and the top Go entry has several version paths of the same module.
So a raw top ten overstates how many separate problems exist. Group by project before you read a ranking.
What to do with it
For triage, the long tail matters more than the leaders. Three in four npm packages with an advisory have only one, which means a typical vulnerable dependency is not famous. A watchlist of well known projects would miss most of your exposure.
For vendor and platform choices, a high count on a large product is not by itself a reason to avoid it. Read the fix rate and how fast patches arrive instead.
For reporting, say whether your counts are by package name, project or advisory.
Safeguard's SBOM and dependency scanning lists every component, including the many quiet ones, and the free scan at https://gold.safeguard.sh/scan shows how many of them have a record.
Try it yourself
Open the demo and look at the dependency inventory, especially how many components appear that you would not have named.
Click through it at your own pace, or open it full screen.
Quick check
Is the package with the most advisories the most dangerous?
Not necessarily. It may be a large application, or a name that duplicates another. Count by project and read fix rates.
Why list package names that carry only one advisory?
Because they are most of the packages. Ignoring them means ignoring most of the exposure.
Sources
- OSV data sources and per-ecosystem downloads, fetched 19 October 2026
- OSV schema, fetched 19 October 2026
Last reviewed: 19 October 2026.
