  The open-source software (OSS) ecosystem suffers from various security
threats and risks, and malicious packages play a central role in software
supply chain (SSC) attacks. Although malware research has a history of over
thirty years, less attention has been paid to OSS malware. Its existing
research has three limitations: a lack of high-quality datasets, malware
diversity, and attack campaign context. In this paper, we first build and
curate the largest dataset of 23,425 malicious packages from scattered online
sources. We then propose a knowledge graph to represent the OSS malware corpus
and conduct malicious package analysis in the wild. Our main findings include
(1) it is essential to collect malicious packages from various online sources
because there is little data overlap between different sources; (2) despite the
sheer volume of SSC attack campaigns, many malicious packages are similar, and
unknown/sophisticated attack behaviors have yet to emerge or be detected; (3)
OSS malicious package has its distinct life cycle, denoted as
{changing->release->detection->removal}, and slightly changing the package
(different name) is a widespread attack manner; (4) while malicious packages
often lack context about how and who released them, security reports disclose
the information about corresponding SSC attack campaigns.
