Q3 2026 Open Source Malware Index: When Compromise Compounds

TL;DR Milestone : Since Sonatype began tracking malicious open source packages in 2017, we have logged nearly 2 million malicious packages. Scale : Sonatype Research Labs logged 149,329 open source malware packages in Q3 2026. npm remained overwhelmingly dominant at 89.5% of the quarter’s malicious packages, although its share declined from 96.6% in Q2.