The State of Software Supply Chain Security 2024: Key takeaways

ReversingLabs’ State of Software Supply Chain Security 2024 highlights the mainstreaming of software supply chain attacks, including a sharp rise in malicious open-source packages (28% year-over-year; 1,300% over three years), shifting activity from npm to PyPI, and pervasive secrets leakage (notably OpenAI API tokens). Using cases like the 3CX build pipeline compromise and the dual-use Operation Brainleeches, the report underscores lower barriers to entry for cybercriminals, the persistence of techniques such as typosquatting and repojacking, and the need for software producers and consumers to augment SCA/SAST/DAST with code/binary provenance and tamper-detection capabilities amid increasing regulatory scrutiny.