The safeguards map / 4.4 Disclosure and advisories
OpenSSF Malicious Packages
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
An open database of reports of malicious packages found on open source package repositories, published as OSV records.
Where it sits
4.4 Disclosure and advisories (primary): Publishes a database of reports of malicious packages found on open source package repositories, as OSV records.
The aim of this project and repository is to be a comprehensive, high quality, open source database of reports of malicious packages published on open source package repositories.
captured
consumable via the [Open Source Vulnerability (OSV)](https://osv.dev) format
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- software
- Used by
- those who make itthose who run it
- Runs
- by hand
Handoffs
produces Vulnerability status: OSV
Collector's note
The sandbox stage is the row in the OpenSSF TAC project table.
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.