Malicious Open Source Packages Spike 188% YoY

Sonatype's Q2 2025 Open Source Malware Index reports a 188% year-over-year rise in malicious open-source packages (16,279 instances) that primarily perform credential and secret exfiltration; the research ties multiple packages to North Korean APT Lazarus and identifies a large, automated campaign attributed to a suspected Chinese actor (Yeshen-Asia). The report highlights attack patterns such as typosquatting, poisoned legitimate packages, and automated publishing to public registries, and recommends SBOMs, provenance validation, sandboxed builds, and monitoring of post-install behavior to mitigate developer and supply-chain risk.