Malicious Packages

Malicious Packages

The aim of this project and repository is to be a comprehensive, high quality, open source database of reports of malicious packages published on open source package repositories.

These public reports help protect the open source community, and provide a data source for the security community to improve their ability to find and detect new open source malware.

The project repository is a collection of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.

This project is closely related to the OpenSSF Package Analysis project.