Supply-Chain Malware Trends

What each feed carried across October 2024 to September 2026

Every malicious advisory in the VDB is classified into exactly one of four feeds: OSSF Malicious Packages (published to OSV.dev, built for SCA scanners), OpenSourceMalware (a commercial catalogue, ingested per user API key), Vulnetix CLI Malscan (standalone GCVE-110 findings, built for SOC detection), and the remaining enriched Vulnetix VDB corpus, which spans more ecosystems than any single upstream feed. Advisories, IOC samples and actionable IOCs are additive; packages and actors are counted distinct within each ecosystem-month bucket. Actionable IOCs exclude the bare package-identifier types (a name, typosquat or version).

A note on the OpenSourceMalware figures. OpenSourceMalware is a commercial threat-intelligence catalogue, the "open source" is the subject (malware in open-source packages), not the licence. Under our agreement Vulnetix ingests OSM data only for users who supply their own OSM API key, so the 12.5K advisories shown here are the slice our users unlocked, not OSM's full catalogue. Vulnetix has also donated malware data back to OSM across several ecosystems.

Explore OpenSourceMalware → · Add your OSM API key to Vulnetix to widen this coverage.

The exposure window: how long is a malicious package installable before OSSF flags it?

We resolved when each malicious package was first published (deps.dev historical index plus the npm and PyPI registries) and compared it to the advisory's publish date, across 217808 OSSF npm packages and 11130 PyPI packages. The gap is how long the package sat installable before anyone was warned.

• 47% of flagged npm packages were already deleted, or their original publish record erased on takedown, by the time we looked.
• Median exposure among the 53% still placeable on a timeline was 521 days; 71% had been installable for over a year.
• On PyPI, 100% of checked packages were already gone from the registry entirely.

By the time an OSSF advisory reaches you the damage is done: anyone who installed the package during the window is already compromised, and the advisory is a post-mortem, not a warning.

Method: first-publish via the deps.dev API; advisory date from the OSV record. Packages absent from deps.dev, or whose only surviving record post-dates the advisory, are reported deleted/erased. Computed continuously in the Vulnetix VDB; sample as of the latest run and growing.

Two audiences: SCA scanners and SOC teams

A malware advisory only helps a scanner if it ships something machine-readable: a hash, a domain, an install command, an attacker account. Counting the actionable indicators per feed shows which reporting a defender can act on.

Where the malware landed

The same 24 months, grouped by the ecosystem each malicious advisory targeted, ranked by advisory count.

What October 2024 to September 2026 showed

Across the window the four feeds reported 249.2K malware advisories over 246.1K packages. Of the 331.8K IOC samples, only 114.4K were actionable indicators, and those, with the 46.8K attributed actors, came overwhelmingly from Vulnetix's own scanning and enrichment rather than the high-volume, name-only upstream advisories. Those advisories are useful, they feed an SCA scanner a blocklist, but they arrive after the fact: most flagged packages had been installable for months, and many were already gone by the time anyone was warned. The value is in the indicators, the attribution and the timing, and that is what the Vulnetix VDB and the install-time Package Firewall are built to carry.

Bucketed per source × ecosystem × month over the trailing window. advisories, iocSamples and actionableIocs are additive; packages and actors are counted distinct within each bucket, so a package or actor spanning multiple buckets is counted in each. actionableIocs is the subset of iocSamples excluding bare package-identifier types (package-name, typosquat, malicious-version) — i.e. the domains, IPs, URLs, hashes and other indicators a scanner can match on.

Know a package is malicious before it installs

The Vulnetix Package Firewall checks every install against this same malware intelligence, across 25+ registries, before the dependency reaches your build. The malicious domains, IPs and URLs behind these counts are also published as free STIX 2.1 feeds.

Start for free · See the Package Firewall · Malware campaigns and threat actors