Malicious Package Statistics
Real-world data on malicious packages detected across package ecosystems
2026 figures represent discoveries through September and will increase as the year progresses.
Total malicious packages since 2018
Malicious Packages Detected
Unique packages identified as malicious in vulnerability reports (2026 data through September)
Cumulative Malicious Packages
Total malicious packages discovered over time
Dramatic Increase in 2026
NPM has seen a -94% increase in malicious packages discovered through September 2026 compared to all of 2025, with 12,243 unique malicious packages detected year-to-date.
PyPI Under Attack
PyPI experienced its peak in 2024 with 2,645 malicious packages, though 2026 numbers remain significant at 1,383 packages.
Common Attack Vectors
How malicious packages compromise developer systems
Creating packages with names similar to popular ones, exploiting common typos
Publishing malicious packages with names matching internal private packages
Hijacking legitimate maintainer accounts to inject malicious code
Methodology
How we collect and analyze malicious package data
These statistics are derived from vulnerabilities in our database that contain the term "malicious" in their summary field (case-insensitive matching). The dataset focuses on actively reported threats, excluding withdrawn vulnerabilities that have been retracted or deemed invalid.
Each statistic represents unique package counts, not vulnerability counts. A single package may have multiple vulnerabilities, but is counted only once in these figures. Our data is continuously updated from OSV.dev vulnerability feeds, ensuring near real-time accuracy of threat intelligence.