Malicious Software Packages: Human-Vetted Supply Chain Threats

Containing human-vetted malicious software packages discovered in real-world environments by DataDog security researchers. Updated as of March 2026, the data focuses on identifying and documenting software supply chain threats found in the wild. It serves as a verified ground-truth set for security tools and malware analysis.

Use Cases

• Training machine learning models to identify malicious code patterns within software packages
• Benchmarking the detection accuracy of supply chain security tools like GuardDog
• Analyzing obfuscation techniques and delivery vectors used in verified malware samples

Strengths

• 100% human-vetted labels ensuring high-confidence ground truth
• Sourced from 'in the wild' real-world malicious instances
• Maintained by DataDog security researchers under an Apache-2.0 license

Limitations

• Unknown record count makes it difficult to assess statistical significance
• Potential selection bias toward packages detectable by the GuardDog security tool
• Lack of structured metadata documentation for individual package attributes

Provenance

Source

DataDog

Collection Method

Human-vetted curation of packages found in the wild

Freshness

Last updated March 2026.

Geography

Global