5 endpoint blind spots your EDR/XDR was never built to see

In August 2025 supply‑chain and marketplace abuse placed malicious npm packages and developer‑workspace extensions into widely used ecosystems (126 malicious npm packages with ~80 live and ~86,000 downloads; VS Code and browser extensions with millions of installs), enabling backdoors and large‑scale data exfiltration across enterprise developer endpoints; the report names PhantomRaven, MaliciousCorgi, DarkSpectre and Team PCP as examples, notes that traditional EDR/XDR did not detect the activity, and recommends Palo Alto Networks' Koi Agentic Endpoint Security to provide visibility, behavioral inspection, sandboxing and real‑time prevention.