Malware Now Dominates Open Source Vulnerability Records, Study Finds

A new research paper examining security trends across major programming language ecosystems has uncovered a striking shift: malware reports in the Open Source Vulnerabilities database have now surpassed traditional vulnerability disclosures as the dominant category of security entries.

The Growing Malware Problem#

Researchers analyzing historical data from six popular programming language package repositories found that malware submissions have accelerated sharply in recent years. By early 2025, malware-related entries comprised up to 80% of all records in the OSV database, marking a significant change in the composition of reported security threats. This pattern underscores how attackers are increasingly targeting open source ecosystems to distribute compromised packages.

A Predictable Trend#

The analysis employed time series modeling to forecast malware submission rates, discovering that relatively straightforward autoregressive models could generate reliable predictions. The researchers incorporated multiple variables—including the number of ecosystems involved, published security advisories, and media coverage—to improve forecast accuracy. These results suggest that malware growth in package repositories follows patterns shaped by broader ecosystem dynamics and public attention.

What It Means#

This research highlights an aspect of open source security that has received comparatively little scholarly attention: the longitudinal evolution of threats over time. By documenting how malware submissions have grown to dominate security database records, the study advances understanding of how packaging ecosystems face mounting pressure from supply chain attacks, and raises questions about detection and mitigation strategies as threat volumes continue to rise.