‘Download pumping’ joins the trust-abuse bandwagon

Tenable researchers describe "download pumping," a supply-chain abuse technique where attackers publish hundreds of package versions to force mirrors, scanners, and bots to download each release, amplifying download counts and fabricating perceived legitimacy; Tenable observed the malicious package "ambar-src" reach roughly 50,000 automated downloads after more than 700 uploads. The report warns this can subvert developer trust signals and AI-driven package recommendations and recommends mitigations such as enforcing minimum-age requirements on new packages, version pinning, least-privilege controls, and layered detection.