In OSV exports downloaded on 19 October 2026, npm lists 222,205 malicious package records and 7,447 vulnerability advisories. Go, Maven and Packagist list almost no malicious records and thousands of advisories. The counts show what each feed contains, not how safe an ecosystem is.
Method
We downloaded the per-ecosystem OSV exports for eight ecosystems on 19 October 2026 (the npm file was last modified on 18 October 2026). We counted records whose ID starts with MAL- as malicious package reports, which is how the OpenSSF Malicious Packages data enters OSV. We counted every other record as a vulnerability advisory. Withdrawn records were excluded from both counts.
Limits: OSV aggregates sources, and each ecosystem has different coverage. A zero for Packagist does not mean zero malicious packages exist. It means the feed lists almost none.
What the numbers say
| Ecosystem | Malicious records | Vulnerability advisories |
|---|---|---|
| npm | 222,205 | 7,447 |
| PyPI | 11,823 | 13,941 |
| RubyGems | 4,304 | 1,091 |
| NuGet | 782 | 1,142 |
| crates.io | 21 | 2,799 |
| Go | 20 | 9,464 |
| Maven | 2 | 7,077 |
| Packagist | 1 | 7,147 |
Three observations.
First, the two kinds of record describe different things. An advisory describes a flaw in a package that someone wrote in good faith. A malicious record says the package itself is the attack. The fix is different: upgrade for the first, remove for the second.
Second, the two sets barely overlap. Of 222,204 distinct malicious npm package names, 386 also have a vulnerability advisory. For PyPI it is 50 of 11,823. A package that is malicious is rarely also a package with a normal advisory.
Third, volume is uneven in time. Two months of npm records, August and November 2025, hold 177,262 of the 222,205, about 80 percent. We cover how to read such spikes in a separate post on reading spikes in malicious package feeds.
What to do with it
Do not rank ecosystems by these counts. They tell you where reporting and ingestion are most active. A low count can mean a quiet registry or a quiet feed.
Do check both lists for what you install. A dependency scan that only reads vulnerability advisories will miss a package that was malicious from the start. Make sure your tooling covers malicious package reports, and that a hit blocks installation or triggers removal, not a normal upgrade ticket.
Finally, treat newly published names with extra care. Malicious reports are heavy on typosquats and lookalike names, so a package you added last week deserves a look.
Safeguard's SBOM and dependency scanning and policy gates can flag known malicious packages in a build, and the free scan at https://gold.safeguard.sh/scan lets you check one repository.
Quick check
Is npm the most dangerous ecosystem?
The data does not say that. It says npm has the most malicious package records in OSV, and two bulk months account for about 80 percent of them.
Why do Maven and Packagist show almost no malicious records?
We can only say that the feed lists almost none. We did not determine whether that reflects fewer attacks or less coverage.
Sources
- OSV data sources and per-ecosystem downloads, fetched 19 October 2026
- OSV schema, fetched 19 October 2026
Last reviewed: 19 October 2026.
