A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.
Star History
Add Live Star History & Verified Badges to README.md
Keep your repository README looking professional and dynamic. As our continuous crawler records new stars, these official SVG badges update in real time with zero maintenance.
Renders your high-resolution star trajectory chart right inside your GitHub README or project docs.
[](https://githubrepo.cloud/repo/ossf/malicious-packages?utm_source=readme_chart)Compact Shields-style badges for your README header. Shows real-time stars and global ranking.
[](https://githubrepo.cloud/repo/ossf/malicious-packages?utm_source=readme_badge) [](https://githubrepo.cloud/repo/ossf/malicious-packages?utm_source=readme_badge) [](https://githubrepo.cloud/repo/ossf/malicious-packages?utm_source=readme_badge)Momentum
+16
STARS · LAST 30 DAYS
1
PER DAY
#689
MOST-STARRED Go
| Window | 7 days | 30 days | 90 days |
|---|---|---|---|
| Stars gained | +7 | +16 | +90 |
| Per day | 1 | 1 | 1 |
| Forks gained | +1 | +3 | +10 |
malicious-packages gained 16 stars in the last 30 days, about 1 a day, and now has 622. It is about 4 years old and has averaged roughly 156 stars a year. It ranks #689 among Go repositories and #6,311 across all languages on GitHubRepo.
Trending Record
2
DAYS ON TRENDING
#6432
BEST RANK
Oct 6, 2026
FIRST APPEARANCE
Active
STATUS TODAY
malicious-packages has maintained a continuous presence across global trending indexes, peaking at #6432. Below is the 30-day activity profile:
💡 Overview
malicious-packages is an open-source project written in Go: A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.
Engineered for speed, consistency, and developer ease, it solves common hurdles in Go. It provides clear interfaces, comprehensive configuration options, and seamless integration with existing tools across the modern development stack.
⚡ Key Features
Optimized execution pipeline written in Go for predictable speed.
Zero-friction configuration with comprehensive sensible defaults out of the box.
Cross-platform runtime support across Linux, macOS, and Windows environments.
Strong typing and modular architecture designed for easy extension and maintainability.
Standardized CLI and API interfaces for smooth integration into CI/CD workflows.
Active community maintenance with regular dependency updates and security patches.
📥 Installation
$ go install github.com/ossf/malicious-packages@latest⚙ System Requirements
Platforms
- • macOS
- • Linux
- • Windows
Runtime & Dependencies
Go >= 1.21 runtime environment
Architecture
x86_64, ARM64 (Apple Silicon & Graviton)
🧠 How It Works
malicious-packages coordinates its core functionality through a modular Go pipeline. It parses configuration parameters, validates inputs, and resolves dependencies asynchronously. By minimizing runtime overhead and keeping allocations localized, it delivers predictable performance in both local development environments and automated production workloads.
🎯 Production Use Cases
Production System Integration
Embed malicious-packages into Go backend services to handle core application logic.
CI/CD Automated Pipelines
Run automated validation, builds, and integration suites during deployments.
Developer Tooling & Workflows
Accelerate developer onboarding with pre-configured project utilities.
Open Source Extension
Fork and customize internal modules under the repository's open Apache-2.0 license.
🚀 Getting Started
Install malicious-packages using your package manager: `go install github.com/ossf/malicious-packages@latest`
Initialize your project workspace or configuration file for malicious-packages.
Import malicious-packages into your codebase or invoke it directly from your terminal.
Execute your test suite or run `malicious-packages --help` to verify successful setup.
👍 Strengths
⚠️ Considerations
⇄ Alternatives & Direct Competitors
👥 Who Should Use This
Developers and engineering teams building with Go, seeking reliable, tested, and actively maintained tooling for production workloads.
🏆 Nearby in the Rankings
ossf/malicious-packages is currently ranked #6,311 by stars across every repository tracked on GitHubRepo. These are adjacent projects:
| Rank | Repository | Language | Stars | Action |
|---|---|---|---|---|
| #6,305 | nahrek/polyledger | Python | ★ 623 | Compare ↗ |
| #6,305 | dlsc-software-consulting-gmbh/GemsFX | Java | ★ 623 | Compare ↗ |
| #6,305 | peej/tonic | PHP | ★ 623 | Compare ↗ |
| #6,305 | ruby/spec | Ruby | ★ 623 | Compare ↗ |
| #6,305 | pyenchant/pyenchant | Python | ★ 623 | Compare ↗ |
| #6,311 | ossf/malicious-packages This Project | Go | ★ 622 | |
| #6,311 | ChrisChen667788/wind-comic | TypeScript | ★ 622 | Compare ↗ |
| #6,311 | BestImageViewer/geeqie | C++ | ★ 622 | Compare ↗ |
| #6,311 | rspatial/terra | C++ | ★ 622 | Compare ↗ |
| #6,311 | DataDog/orchestrion | Go | ★ 622 | Compare ↗ |
| #6,311 | basecamp/activerecord-tenanted | Ruby | ★ 622 | Compare ↗ |
Frequently Asked Questions
What does malicious-packages do? +
A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.
What language is malicious-packages written in? +
The primary language is Go. Topics include: software.
Is malicious-packages actively maintained? +
Yes, the last recorded push was on Oct 6, 2026 with 60 open issues being tracked.
How many stars does malicious-packages have? +
malicious-packages has 622 stars and 157 forks on GitHub.
How does malicious-packages rank among GitHub repositories? +
With 622 stars, ossf/malicious-packages is ranked #6,311 globally across all repositories tracked on GitHubRepo and #689 among Go projects.
What license is malicious-packages distributed under? +
The repository reports a Apache-2.0 license. Always verify the repository LICENSE file for legal terms.
