Since Sonatype began tracking malicious open source packages in 2017, we have logged nearly 2 million malicious packages.