Less malware, more risk: The changing face of open-source security

ReversingLabs' 2025 Software Supply Chain Security Report finds that while detected malicious packages on major OSS repositories dropped sharply in 2024, software supply chain risks increased: notable incidents include an XZ Utils maintainer compromise that injected a backdoor, a GitHub Actions script-injection breach of Ultralytics, npm packages exfiltrating SSH keys, a 12% rise in leaked developer secrets, and numerous critical/high vulnerabilities in popular packages (e.g., Torchvision), underscoring that popularity does not equal security and that organizations must better vet OSS dependencies.