Researchers Uncover 454,000+ Malicious Open Source Packages

Sonatype's 2026 State of the Software Supply Chain report warns of a structural risk in public package registries after detecting 454,648 new malicious packages and describing industrialized, multi-stage supply-chain campaigns (including possible state-sponsored activity), widespread high-severity open-source vulnerabilities, and additional risks introduced by AI-assisted dependency management and package mimicry.