In 2025, 92% of npm account takeovers occur.

Publisher	Endor Labs
Report	Malware in Open Source Ecosystems
Published	1 April 2026
Topics	Open Source, Supply Chain, Account Takeover

Published by Endor Labs in Malware in Open Source Ecosystems, 1 April 2026. The figure is taken from the report as published; the full methodology is in the source.

View the original report

Related statistics

Only 6.1% of Mythos disclosures are marked as patched, despite 90.9% maintainer acknowledgment.

Tuskira, 28/06/2026

In the first 63 days of the Anthropic Claude Mythos Preview, Mythos disclosed 1,596 verified vulnerabilities across 281 open-source projects.

Tuskira, 28/06/2026

Malware operators compromised 350 GitHub repositories to inject malicious code into JavaScript and Python projects.

CrowdStrike, 15/06/2026

The Axios NPM package was downloaded 100 million times per week.

CrowdStrike, 15/06/2026

89% of UK IT decision makers agree that public policy and regulation should mandate open source principles such as transparency and auditability to help organisations achieve AI sovereignty.

Red Hat, 27/05/2026

80% of IT decision makers see open source as providing greater control over how AI is built and where it runs.

Red Hat, 27/05/2026

Get the newsletter

Weekly cybersecurity statistics by email.