OpenSSF Releases Malicious Packages Repository
Written by Alex Denham   
Thursday, 26 October 2023

The OpenSSF Package Analysis team has released a Malicious Packages repository, which they describe as an open source system for collecting and publishing cross-ecosystem reports of malicious packages.

The OpenSSF says they've developed the repository in response to increasing attacks that include malicious open source packages. The hope is that a centralized repository for shared intelligence could alert the community to attacks and help clarify what threats are out there.



Malicious packages in this context are malware that is delivered as an open source package and published to a package repository, such as PyPI or NPM. The packages are then used to attack the developers or companies that unwittingly install and run them.

The Package Analysis project aims to find malicious packages as soon as possible by downloading, installing and executing packages from popular open source package repositories as they are published. As the packages are run, the software captures executed commands and analyze network traffic to work out if the package is acting maliciously. If it is, a report is generated and published to the new Malicious Packages repository.

The repository will also create a public database that aggregates reports of malicious packages with the aim of stopping malicious dependencies from moving through CI/CD pipelines, and scanning for and preventing their use. The reports in the Malicious Packages repository use the Open Source Vulnerability (OSV) JSON format. This makes it is possible to make use of existing integrations, including the API, the osv-scanner tool, and

The repository already has over 15,000 reports of malicious packages, with current data being sourced from the OpenSSF Package Analysis project, Checkmarx security and exports of malicious packages tracked by GitHub.



More Information

OpenSSF Malicious Packages Repository

Related Articles

Taking Open Source Criticality Seriously

The State Of Secure Software Development - Three OpenSSF Courses


To be informed about new articles on I Programmer, sign up for our weekly newsletter, subscribe to the RSS feed and follow us on Twitter, Facebook or Linkedin.


The Pi 5 Breaks The Mold

The Pi 5 is an exciting development bringing even more power for not much additional cost, but it also signals a bigger change in the Pi line-up, obscured by secretiveness.

The Art Of Computer Programming - A Great Present

If you are looking for a programmer present this holiday season, there is one book, or set of books, that should be top of any list... Donald Knuth's The Art of Computer Programming.

More News




or email your comment to: