Package-malware feeds on npm and PyPI: study data, 2026-10

Data of an open study of package-malware feeds on npm and PyPI: OpenSSF malicious-packages with the tools its records name (GitHub's malware advisories among them) and Vulnetix's GCVE advisory database as it stood on 24 October 2026. It covers what the registries did about 242,072 flags (stage 1, a stratified sample of 7,483), how many of the flags registries left up are benign (stage 2, two model raters and human adjudication), what four open scanners catch and how many false alarms they raise (stage 3), and what each feed's records show and how feeds answer disputes (section 9). The method was fixed before the results. No package file is included, and the names of packages read as benign are withheld. code/verify_archive.py recomputes every number from these files. The data are CC BY 4.0; the code inside the archive is MIT, as its README says. Write-up: https://github.com/alexar76/aicom/blob/7ae8dbc407a736d8469e647e75a012b1e7d1bdfa/docs/malware-feed-accuracy.md