Reported by 2 outlets
Q3 2026 Open Source Malware Index: When Compromise Compounds
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.02 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.1 / 10 = base × recency + community
Analysis
Sonatype’s Q3 2026 index logged 149,329 malicious open-source packages - bringing the cumulative total since 2017 to nearly 2 million. npm accounted for 89.5% of the quarter’s malicious packages (133,579), though its share declined from 96.6% in Q2. Among overt malware, 74.5% involved droppers, secrets exfiltration, or both, showing a shift toward multi-stage attacks that extend beyond initial package installation.
Defenders face shorter windows: automation is reducing the gap between initial compromise and follow-on impact such as credential theft and persistence. The scale means dependency scanning must treat malicious packages as an inevitable supply-chain risk rather than a rare anomaly, with faster containment prioritized over perfect prevention.
Timeline
-
original reporting
Q3 2026 Open Source Malware Index: When Compromise Compounds
malware.news · 5d ago · October 8th, 2026
TL;DR Milestone : Since Sonatype began tracking malicious open source packages in 2017, we have logged nearly 2 million malicious packages. Scale : Sonatype Research Labs logged 149,329 open source malware packages in Q3 2026. npm remained overwhelmingly dominant at 89.5% of the quarter's malicious packages, although its share declined from 96.6% in Q2. Behavior : Among packages containing overt-malware behavior, 74.5% involved droppers, secrets exfiltration, or both, showing how often Q3 malware was designed to extend the attack beyond initial execution. Defender challenge : Automation is shortening the distance between initial compromise and follow-on impact, giving defenders less time to contain credential theft, payload delivery, persistence, and further trusted access. In the third quarter of 2026, Sonatype identified 149,329 malicious open source packages across ecosystems, bringing the total logged since tracking began in 2017 to 1,960,846. npm once again accounted for the overwhelming majority this quarter, with 133,579 packages making up 89.5% of the quarter's total. While those numbers make Q3 2026 look like another story about npm and sheer malicious-package volume, that wasn't the case. The
-
update from www.sonatype.com
(sonatype.com) Open Source Malware Surge: How Compromised Packages Extend Attack Chains Beyond Initial Execution In brief - This article ana
www.sonatype.com · 5d ago · October 8th, 2026
(sonatype.com) Open Source Malware Surge: How Compromised Packages Extend Attack Chains Beyond Initial Execution In brief - This article ana
via Mastodon https://www.sonatype.com/blog/q3-2026-open-source-malware-index-when-compromise-compounds