Malicious Open Source Software Packages Neared 500,000 in 2025

Sonatype's "State of the Software Supply Chain" report documents a dramatic escalation of malicious open-source packages in 2025—over 454,600 new malicious packages concentrated on npm—driven by industrialized campaigns that include nation-state actors (e.g., Lazarus), mass-created packages (IndonesianFoods), self-replicating npm malware (Shai-Hulud), and high-severity vulnerable releases that together create ecosystem-wide supply chain risk.