Of 222,536 npm malicious package records in the OSV dumps, 140,728 (63%) mention one token reward campaign that flooded the registry with auto-generated packages. All of those records were published in November 2025. Charts of "malware found" mostly show the volume of a few bulk events, not steady attacker activity.
Method
We downloaded the per-ecosystem OSV dumps for npm, PyPI, Go, Maven, RubyGems, crates.io and NuGet on 19 October 2026. That gave 283,989 records, of which 239,513 have IDs starting MAL, the prefix used by the OpenSSF malicious-packages project. For npm we read the text of each of the 222,536 MAL records and searched the details for the phrase "tea.xyz". We then counted records by published date.
We relied on the record's own wording about the campaign and did not verify the campaign independently.
What the records say
The matching records say the package appears to be part of a token reward campaign that flooded npm. They describe autopublish scripts that generate and publish derivative packages with randomised names to inflate reputation scores, and they say the payload edits package.json, changes version numbers and keeps republishing variants. The OpenSSF repository states that spam packages, even trivial or empty ones, are allowed in the dataset, which is why they are present.
The numbers
| Group | npm MAL records |
|---|---|
| All | 222,536 |
| Mention the campaign | 140,728 |
| Everything else | 81,808 |
All 140,728 campaign records carry a November 2025 published date. In that month there are 142,163 npm MAL records in total, so the campaign is 99% of the month.
A second bulk event sits in August 2025. On 14 August 2025 alone, 34,306 records were published that do not mention the campaign. We did not establish what they are. Their text is short ("was found to contain malicious code") and has no source section. We list them as unexplained.
What the rest looks like
With the campaign removed, npm records by year published are 7,424 in 2022, 2,291 in 2023, 8,372 in 2024, 50,692 in 2025 and 13,024 in 2026 so far. Remove the 14 August 2025 batch as well and 2025 drops to 16,386. Counted that way, 2026 so far (13,024 records in under ten months) is close to the full 2025 figure. Monthly counts in 2026 run from about 330 to about 4,000.
How to read a malware chart
- Ask whether a few days or campaigns drive the total. Sort by day before you draw a line.
- Separate spam from harmful packages if the data lets you.
- Compare ecosystems by rate per month in quiet periods, not by all-time totals.
- Do not conclude from a count that one registry is safer. npm has far more records, but also far more packages and far more scanning.
For your own defence, the useful number is not the total. It is whether packages you depend on, or could be tricked into installing, appear in any of these reports.
Safeguard's SBOM and dependency scanning lists the components you run, and reachability analysis helps separate vulnerable code your application calls from code it does not. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Are the campaign packages harmless because they are spam?
Not necessarily. The records describe code that modifies files and republishes itself. They are a nuisance for registries and a risk if one is installed by mistake.
Why does OSV list spam as malicious?
The OpenSSF project says spam or trivial packages are allowed in the dataset, so counts include them.
Sources
- OSV data sources and dumps, per-ecosystem OSV dumps downloaded on 19 October 2026.
- OpenSSF malicious-packages repository, the source of the MAL records in the OSV dumps.
Last reviewed: 19 October 2026.
