Malicious Package Statistics
Real-world data on malicious packages detected across package ecosystems
2026 figures represent discoveries through June and will increase as the year progresses.
Total malicious packages since 2018
Malicious Packages Detected
Unique packages identified as malicious in vulnerability reports (2026 data through June)
Cumulative Malicious Packages
Total malicious packages discovered over time
Dramatic Increase in 2025
NPM has seen a 2198% increase in malicious packages discovered through June 2025 compared to all of 2024, with 191,336 unique malicious packages detected year-to-date.
PyPI Under Attack
PyPI experienced its peak in 2023 with 6,474 malicious packages, though 2025 numbers remain significant at 1,257 packages.
Common Attack Vectors
How malicious packages compromise developer systems
Creating packages with names similar to popular ones, exploiting common typos
Publishing malicious packages with names matching internal private packages
Hijacking legitimate maintainer accounts to inject malicious code
Methodology
How we collect and analyze malicious package data
These statistics are derived from vulnerabilities in our database that contain the term "malicious" in their summary field (case-insensitive matching). The dataset focuses on actively reported threats, excluding withdrawn vulnerabilities that have been retracted or deemed invalid.
Each statistic represents unique package counts, not vulnerability counts. A single package may have multiple vulnerabilities, but is counted only once in these figures. Our data is continuously updated from OSV.dev vulnerability feeds, ensuring near real-time accuracy of threat intelligence.