1,546 Reviewed GitHub Advisories in 46 Days: npm, PyPI and Go Lead

From 1 September to 16 October 2026, 1,609 GitHub-reviewed advisories were published across package ecosystems, per OSV's mirror of the GitHub Advisory Database. 63 were later withdrawn, leaving 1,546 active entries. npm has 533 of them, PyPI 359 and Go 313.

We counted from public bulk files downloaded on 18 October 2026. This post shows how, so the numbers are reproducible, and what the split means for your triage queue.

How we counted

OSV publishes one zip per ecosystem. Every GitHub advisory in those zips has an ID starting with GHSA- and a database_specific block with the GitHub severity and a github_reviewed flag. We kept records whose published date falls from 2026-09-01 to 2026-10-16 inclusive (UTC).

for e in npm PyPI Go Maven NuGet RubyGems crates.io Packagist Pub Hex; do
  curl -sS -o "$e.zip" "https://osv-vulnerabilities.storage.googleapis.com/$e/all.zip"
done

import zipfile, json, collections

rows = []
for eco in ["npm", "PyPI", "Go", "Maven", "NuGet", "RubyGems",
            "crates.io", "Packagist", "Pub", "Hex"]:
    z = zipfile.ZipFile(f"{eco}.zip")
    for name in z.namelist():
        if name.startswith("GHSA-"):
            d = json.loads(z.read(name))
            if "2026-09-01" <= d["published"][:10] <= "2026-10-16":
                d["_eco"] = eco
                rows.append(d)

active = [d for d in rows if not d.get("withdrawn")]
print(len(rows), "entries,", len({d["id"] for d in rows}), "unique IDs,", len(active), "active")
for eco, n in collections.Counter(d["_eco"] for d in active).most_common():
    sev = collections.Counter(d["database_specific"]["severity"]
                              for d in active if d["_eco"] == eco)
    print(eco, n, dict(sev))

A count is per advisory per ecosystem. An advisory that affects two ecosystems appears in both zips and counts once in each. That is why there are 1,609 entries but 1,585 unique IDs. Every entry in the window has github_reviewed set to true.

What's affected

Counts are by the severity label GitHub assigns, not by a CVSS score we computed. 1,512 of the 1,546 active entries (97.8%) list at least one fixed version.

A few packages produce a lot of advisories

The 1,546 entries cover 587 distinct packages, going by the first affected package listed in each record. 361 of those packages have a single advisory. The ten busiest account for 260 entries, or 16.8%:

An advisory count tells you how much reporting a project got, not how risky it is to run. One maintainer receiving a batch of reports shows up as a spike here.

How to check if you're exposed

Pull the advisories for the packages you actually use instead of reading the whole feed. OSV answers per package:

curl -s -X POST https://api.osv.dev/v1/query \
  -d '{"package":{"name":"vm2","ecosystem":"npm"},"version":"3.9.19"}' \
  | python3 -c 'import json,sys; [print(v["id"]) for v in json.load(sys.stdin).get("vulns",[])]'

Replace the name, ecosystem and version with a line from your lockfile.

What to do now

1. Triage by what you run, not by ecosystem totals. npm leads on volume, but NuGet had the highest share of High or Critical entries at 73.3%, on a small base of 75.
2. Expect upgrades, not workarounds. 97.8% of entries list a fixed version, so most of the queue is a version bump.
3. Look for packages with many advisories in your tree. If one of the ten above is a direct dependency, expect more upgrade pressure from it.
4. Deduplicate before you count. Raw advisory counts overstate unique issues: 63 entries in this window were withdrawn as duplicates.

Quick check

Sources

• OSV npm all.zip
• OSV PyPI all.zip
• OSV Go all.zip
• OSV API query endpoint
• GitHub Advisory Database