Data source
OSV
OSV is Google’s open database of vulnerabilities in open source packages. It combines several sources, including the GitHub Advisory Database (CC BY 4.0), the PyPI Advisory Database (CC BY 4.0) and OpenSSF Malicious Packages (Apache 2.0). We count npm and PyPI entries by date and publish no advisory text.
Supporting context; these measurements do not directly affect the score.
Data from OSV, including the GitHub Advisory Database, PyPI Advisory Database and OpenSSF Malicious Packages. We count entries and publish the results.
Visit the sourceBackground for: SecurityLicense: CC BY 4.0 and Apache 2.0, by upstream database
Advisories256402
Malicious packages234540
npm malicious222591
PyPI malicious11949
What the data shows
Computed from every record, as of Nov 1, 2026.
- 91% of npm and PyPI advisories are malicious packages rather than bugs in real software.
- 192,552 malicious package reports are dated 2025, against 10,962 in 2024 and 14,819 so far in 2026. A swing that large suggests bulk reporting, so it is not a clean trend.
- Ordinary vulnerability advisories reached 10,233 in 2026, against 1,575 in 2025.
Published per year
| Year | Malicious packages | Vulnerabilities |
|---|---|---|
| 2022 | 7444 | 2432 |
| 2023 | 8758 | 1195 |
| 2024 | 10962 | 1412 |
| 2025 | 192552 | 1575 |
| 2026 (to Nov 1, 2026) | 14819 | 10233 |
Limitations
- Only npm and PyPI are included so far.
- Malicious package reports arrive in bulk, so yearly swings are not a clean trend.