Q3 2026 Open Source Malware Index: When Compromise Compounds
From the source: Sonatype Blog
TL;DR Milestone : Since Sonatype began tracking malicious open source packages in 2017, we have logged nearly 2 million malicious packages. Scale : Sonatype Research Labs logged 149,329 open source malware packages in Q3 2026. npm remained overwhelmingly dominant at 89.5% of the quarter's malicious packages, although its share declined from 96.6% in Q2. Behavior : Among packages containing…
Read the full story on Sonatype BlogAsk the square
The story is what was announced. If it raises a question for your team, ask the people who run this technology day to day. Your post links back to this story, so the next reader finds it too.
Recent threads in DevOps & Platform Engineering
How are you measuring platform engineering success?
DORA metrics, developer surveys, time-to-first-deploy, cost per service? What convinced leadership the platform team is worth it?
What is in your internal developer platform, and what did developers actually adopt?
Golden paths, templates, portals, self-service environments. Which parts get used every day and which became shelfware?
Something wrong or out of date? Suggest a correction. We reply within 5 business days.
More from Sonatype
Recent updates from Sonatype, so you can tell whether this is a one-off or part of a pattern.
More in DevOps & Platform Engineering
What other companies in DevOps & Platform Engineering are doing. The category page shows who’s active, side by side.
