Malware in Open Source Ecosystems

Fewer than half of organizations plan to increase budgets for 2026.

88% of IT professionals across DevOps, Security, and Software Engineering roles say the first few days after a package release are the riskiest.

Only 21% of organizations enforce protections like cooldown periods.

In 2025, more than 90% of open source vulnerability (OSV) malware advisories were reported, a 14x increase over the past two years.

Only 14% of previously compromised npm packages use modern security controls like Trusted Publishing.

81% of organizations name OSS malware a top security priority.

In 2025, 92% of npm account takeovers occur.