Yes, from the original github report: "Analysis on a random sample of 521 advisories from across our six ecosystems finds that 17% of the advisories are related

Yes, from the original github report: "Analysis on a random sample of 521 advisories from across our six ecosystems finds that 17% of the advisories are related to explicitly malicious behavior".