malicious-packages
✅ Recently maintainedA repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.
641Stars
175Forks
+87-day stars
Go · Apache-2.0 · Last push 2026-11-02
Official repository & installation ↗GitValue · Value evidence
Unscored · Evidence coverage 0%
Provisional rubric; documentation and runtime testing are separate. Missing evidence does not imply low value.
Star history
2025-09-292026-11-02
View historical data
| Date | Stars |
|---|---|
| 2026-10-04 | 618 |
| 2026-10-05 | 619 |
| 2026-10-06 | 620 |
| 2026-10-07 | 620 |
| 2026-10-08 | 621 |
| 2026-10-09 | 621 |
| 2026-10-10 | 622 |
| 2026-10-11 | 622 |
| 2026-10-12 | 624 |
| 2026-10-13 | 627 |
| 2026-10-14 | 627 |
| 2026-10-15 | 627 |
| 2026-10-16 | 627 |
| 2026-10-17 | 628 |
| 2026-10-18 | 628 |
| 2026-10-19 | 629 |
| 2026-10-20 | 629 |
| 2026-10-21 | 632 |
| 2026-10-22 | 632 |
| 2026-10-23 | 632 |
| 2026-10-24 | 632 |
| 2026-10-25 | 632 |
| 2026-10-26 | 633 |
| 2026-10-27 | 634 |
| 2026-10-28 | 637 |
| 2026-10-29 | 639 |
| 2026-10-30 | 640 |
| 2026-10-31 | 640 |
| 2026-11-01 | 640 |
| 2026-11-02 | 641 |
Get the project
git clone https://github.com/ossf/malicious-packages.gitCloning downloads the source. For dependencies and installation, follow the project README.
Related projects & alternative candidates
Related domains do not imply feature parity. Review official documentation and licenses.