1. Executive summary
Modern software is assembled, not written. A single application routinely draws on hundreds of third-party components, pulled in on demand and updated continuously as part of normal process. That convenience has quietly become a dependable initial-access route that bypasses traditional perimeter and endpoint defenses. Rather than breaching a hardened production perimeter, adversaries increasingly compromise the developer, the maintainer account, the build pipeline, or the package registry — and let trusted automation carry their code the rest of the way.
The scale is now documented rather than theoretical. Sonatype reports a 156% year-on-year rise in newly published malicious open-source packages — more than half a million logged in a single year — against a backdrop of an estimated 6.6 trillion open-source downloads [1][2]. Government bodies have moved from general advisories to named alerts: in September 2025 CISA issued guidance on a self-replicating npm worm that compromised more than 500 packages [3]. The pattern spans every major ecosystem and every class of actor.
What began in 2018 as the isolated act of a single rogue maintainer has industrialized. The techniques have converged on a small set of repeatable mechanisms, and the actors have expanded from opportunistic criminals to patient, state-aligned operators running factory-model campaigns. A significant recent development is self-propagation: worms that harvest developer credentials to republish themselves across the packages their victims maintain.
No single control answers this. The defensible response pairs hard development-lifecycle controls with intelligence that can read a fast-moving, cross-ecosystem threat — turning scattered advisories into tracked campaigns, and tracked campaigns into action. This report sets out the mechanisms, the evidence, and where structured threat intelligence earns its place.
What this report covers
- Breadth — the primary mechanisms by which developer dependency culture is exploited, each illustrated with named, documented incidents.
- Data — the headline figures on scale and their structural implication for defenders, with vendor claims flagged as such.
- Trajectory — how the threat has evolved from 2018 to 2026, including the shift to self-propagating and nation-state campaigns.
- Intelligence — where a threat intelligence platform fits into the response, and, candidly, where it does not.
2. Setting the scene: The logic has inverted
For most of the last decade, defenders concentrated on the perimeter and the endpoint. Supply chain attacks reversed that logic. Attacking a well-resourced target directly is expensive and uncertain; compromising one upstream component the target already trusts converts that trust into access — malicious code arrives pre-approved, reaching thousands of downstream victims at once. SolarWinds made the logic explicit in 2020: a single trojanized software update reached roughly 18,000 organizations [4]— though the vendor's own later analysis to the SEC estimated that fewer than 100 were compromised [5], a distinction frequently lost in reporting. The reach is the objective; the trust is the vulnerability.
The open-source ecosystem magnifies this. Sonatype's 2024 analysis records open-source consumption at an estimated 6.6 trillion downloads in a single year, and reports that 80% of application dependencies remain un-upgraded for more than a year even when fixes exist, while newly published malicious packages rose 156% year-on-year (Sonatype telemetry) [1]. Defenders therefore face a large, fast-moving attack surface that most organizations neither inventory nor monitor. Academic measurement reached the same conclusion years earlier: a 2019 study of npm found that a small number of maintainer accounts could, if compromised, reach a large fraction of the entire ecosystem [6].
3. The mechanisms
Documented incidents cluster into a small number of recurring mechanisms. Each is illustrated below with named entities and specific, sourced outcomes, and annotated with the actors that favor it. Knowing who's behind an attack adds useful context, but it's the mechanism that matters most for defense.
Account takeover - the fastest route from one stolen credential to millions of installs
The most repeatable technique needs no vulnerability: steal a maintainer's credential and publish a malicious version that trusted automation will pull. In October 2021, attackers hijacked the npm library ua-parser-js, then attracting around 8 million weekly downloads, and briefly served a cryptominer and a credential stealer [7]. Within weeks the same pattern struck coa and rc, two packages with over 20 million combined weekly downloads [8]. These are commodity-crime operations, fast and financially motivated, and they succeed because unpinned version ranges and automatic updates distribute the payload before defenders can react.
The technique has since acquired the ability to spread on its own. In September 2025 CISA issued a named alert on a self-replicating npm worm, publicly tracked as Shai-Hulud, that compromised more than 500 packages. It harvested developer and CI credentials and used them to republish itself across the victims' other packages [3]. The turn from manual account takeover to worm marks a step change in this category: the attacker no longer distributes the payload; the ecosystem does.
Dependency confusion - when a package manager's default trusts the wrong source
In February 2021 researcher Alex Birsan demonstrated a flaw in how many build systems resolve package names: when the same name exists in both a private and a public registry, they pull whichever carries the higher version number, even if that means reaching out to the public one. By publishing public packages that matched the internal names of major companies, he achieved code execution inside the networks of Apple, Shopify and PayPal. By his own account, he was awarded more than $130,000 in bug bounties across more than 35 organizations, Microsoft among them [9]. There was no phishing and no malware delivery, only a design default and blind trust in name resolution.
Because the root cause is configuration rather than a discrete bug, exploitation did not stop with the disclosure. Copycat packages targeting named companies appeared within weeks, and the technique remains a staple of both red-team and criminal activity because internal package names leak routinely through public code, error messages and build artifacts. This is a mechanism defined by ecosystem design, not by any single actor.
The trusted insider - patience as a technique
Some of the most dangerous compromises exploit not a stolen account but a granted one. In 2018 the maintainer of the widely used event-stream package handed control to a volunteer who had built credibility through legitimate contributions; that volunteer added a dependency whose obfuscated payload activated only inside the build of a specific Bitcoin wallet, targeting high-value accounts. The malicious code reached millions of downloads before a developer noticed it by chance [10][11].
The same pattern, executed with far greater patience, produced the xz-utils backdoor disclosed in March 2024 (CVE-2024-3094, CVSS 10.0). An actor using the name "Jia Tan" spent roughly two years building trust, aided by sock-puppet accounts that pressured an overburdened solo maintainer. Having earned release rights, the actor hid a remote-code-execution backdoor in the release tarballs of a compression library present in most Linux distributions. It was caught almost by accident, through a half-second SSH delay [12][13]. No nation-state has been formally named; the patience and sophistication are widely assessed as consistent with a state actor, but attribution here remains an assessment, not a fact.
The build pipeline - compromise the factory, not the product
The pipeline that assembles and signs software is a high-value target because its output is trusted by definition. SolarWinds (2020) remains the archetype: an intrusion into the build environment inserted a backdoor into signed Orion updates. The trojanized build was downloaded by roughly 18,000 organizations [5], though only a far smaller subset was actively exploited for espionage. Mandiant attributed the activity to a group later merged into APT29 [4], and Western governments attributed it to Russia's SVR. The signature was trusted, so the malware inherited that trust.
The same logic now applies to the open-source build ecosystem. In March 2025 the widely used GitHub Action tj-actions/changed-files was compromised (CVE-2025-30066) [14]: a stolen token let the attacker alter the action and retroactively repoint its version tags to a malicious commit that dumped CI secrets into build logs across more than 23,000 repositories [15]. Only commit-hash pinning, not tag pinning, resisted it. Investigators found no sign the stolen secrets were exfiltrated to an attacker's server, and public repositories were hit hardest [15]. Either way, the lesson stands: any tag or reference that can be changed can be changed by an attacker.
The registry as attack surface - industrialized, nation-state package publishing
The most organized activity treats the public registry as a delivery channel. North Korea's "Contagious Interview" operation lures developers with fake recruiter approaches and coding assignments whose dependencies deliver credential- and wallet-stealing malware. The campaign has been tracked across multiple vendors and documented in MITRE ATT&CK [16]. Socket's threat researchers documented more than 338 malicious npm packages with over 50,000 downloads in a single mid-2025 window, describing the operation as a factory-model supply-chain threat rather than opportunistic crime [17].
This is a nation-state adversary running the same commodity techniques at industrial cadence, with continuous re-uploads after takedowns: typosquatted package names, install-time scripts, obfuscated multi-stage loaders. Whether the attacker is a lone criminal or a nation-state, the mechanisms are the same. That's the reason to organize a defense around how they operate rather than who they are.
The developer's toolchain - the IDE is the new endpoint
The attack surface now reaches the tools developers run locally. In May 2026 GitHub confirmed that roughly 3,800 internal repositories were exfiltrated after an employee installed a poisoned version of the Nx Console extension for Visual Studio Code — a marketplace extension with more than two million installs and verified-publisher status [18]. On startup the extension silently ran a command that fetched a hidden payload and harvested tokens for GitHub, npm and cloud services. GitHub attributed the intrusion to TeamPCP (tracked as UNC6780), the same actor behind the Mini Shai-Hulud worm. The poisoned extension itself came from a separate npm supply-chain compromise, one vector feeding the next [19].
The pattern predates it. In December 2024 a consent-phishing email tricked a Cyberhaven developer into granting a malicious application access to the Chrome Web Store, bypassing multi-factor authentication; the attacker then published a malicious version of the company's browser extension that auto-updated to users and stole their session cookies [20]. Researchers tied it to a wider campaign affecting at least 35 extensions and roughly 2.6 million users [21]. Editor and browser extensions run with the developer's privileges, update automatically, and are rarely inventoried. That’s why the IDE is now best treated as an endpoint in its own right.
4. Second-order effect: The maintainer paradox
Beneath these mechanisms sits a deeper problem few defenders talk about. Open source depends on volunteers working for free. The xz-utils backdoor succeeded partly because a single exhausted maintainer was pressured into accepting help [12]. At the same time, the standard security advice is to patch quickly, yet the attack vector in nearly every case above is the trusted, automatic update itself. Organizations are told both to update continuously and that updates are how they get compromised.
The data underlines the bind: Sonatype reports that 80% of dependencies go un-upgraded for over a year even when fixes exist [1], so the ecosystem is simultaneously too slow to patch known flaws and too fast to absorb freshly published malicious versions. The emerging resolution isn’t “update more” or “update less” but “update deliberately”. That means holding off on brand-new releases, fast-tracking verified security fixes, and directing support to the maintainers whose unpaid work underpins the whole structure.
5. Where intelligence fits
No single tool closes this gap, and it would be misleading to suggest otherwise. The controls that actually block a malicious package from entering a build sit in the development lifecycle: registry firewalls, software composition analysis, provenance, and pinning. What structured threat intelligence adds sits above that layer: making sense of a threat that moves faster than any one team can read. The volume of advisories across CISA, vendor research and academic sources has become impractical to track by hand, and the same campaign routinely resurfaces under different names, across different ecosystems, weeks apart.
A threat intelligence platform earns its place by aggregating that scattered reporting into a single normalized picture, tracking a campaign across its waves and mapping it to a shared framework such as MITRE ATT&CK, holding attribution with explicit confidence rather than false certainty, and moving the resulting indicators to the controls that enforce them. Intelligence also flows back the other way. A security control might report a single sighting: one flagged package, one matched hash. On its own that reads as routine noise. Matched against known campaigns, the same sighting can reveal that the flagged package belongs to an active operation like Shai-Hulud, turning a minor alert into the first sign of a serious, credential-stealing intrusion.
EclecticIQ builds its Intelligence Center around exactly that role, turning a flood of disconnected incidents into a coherent, usable view. It's also clear about where the job stops: enforcement has to happen in the development pipeline itself. Intelligence does not block the package; it ensures the organization sees the threat, and its evolution, in time to act.
6. Conclusion
Across seven years, every major ecosystem, and every kind of attacker, the evidence points the same way: developer dependency culture is now a primary attack surface, not an emerging one. The convenience that lets teams build software from thousands of trusted components is exactly what attackers exploit, and they've settled on a small, well-understood set of methods to do it. The direction of travel is toward more automation and organization: self-propagating worms, and nation-state campaigns run like factories. But the defenses aren't obscure or unknown. Pinning and provenance, phishing-resistant authentication, disabled install scripts, a deliberate update cadence, and a dependency inventory all address the documented methods directly. For most organizations the gap isn't knowing about these controls, it's having visibility into an attack surface they've never mapped.
Intelligence does not replace those controls; it makes them timely. In a landscape where the same campaign reappears under new names within days, the organizations that manage this risk best will be those that can see the threat coherently and act before the next trusted update carries it in. That is the work this report is intended to support: not certainty, but a clearer view of where the risk lives and what to do about it.
7. References
- Sonatype (2024) 10th Annual State of the Software Supply Chain Report — Introduction. Available at: https://www.sonatype.com/state-of-the-software-supply-chain/2024/introduction (Accessed: 8 July 2026).
- Sonatype (2024) 10th Annual State of the Software Supply Chain Report Reveals 156% Surge in Open Source Malware (press release). Available at: https://www.sonatype.com/press-releases/sonatypes-10th-annual-state-of-the-software-supply-chain-report (Accessed: 8 July 2026).
- Cybersecurity and Infrastructure Security Agency (2025) Widespread Supply Chain Compromise Impacting the npm Ecosystem. Available at: https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem (Accessed: 8 July 2026).
- Mandiant / Google Cloud (2020) Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims with SUNBURST Backdoor. Available at: https://cloud.google.com/blog/topics/threat-intelligence/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor (Accessed: 8 July 2026).
- SolarWinds Corp. (2021) Form 10-Q, Investigative Update. U.S. Securities and Exchange Commission. Available at: https://www.sec.gov/Archives/edgar/data/1739942/000173994221000080/swi-20210331.htm (Accessed: 8 July 2026).
- Zimmermann, M., Staicu, C.-A., Tenny, C. and Pradel, M. (2019) ‘Small World with High Risks: A Study of Security Threats in the npm Ecosystem’, USENIX Security Symposium. Available at: https://arxiv.org/pdf/1902.09217 (Accessed: 8 July 2026).
- Cybersecurity and Infrastructure Security Agency (2021) Malware Discovered in Popular npm Package, ua-parser-js. Available at: https://us-cert.cisa.gov/ncas/current-activity/2021/10/22/malware-discovered-popular-npm-package-ua-parser-js (Accessed: 8 July 2026).
- BleepingComputer (2021) Popular npm library hijacked to install password-stealers, miners. Available at: https://www.bleepingcomputer.com/news/security/popular-npm-library-hijacked-to-install-password-stealers-miners/ (Accessed: 8 July 2026).
- Birsan, A. (2021) ‘Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies’, Medium. Available at: https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610 (Accessed: 8 July 2026).
- npm, Inc. (2018) Details about the event-stream incident. Available at: https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident (Accessed: 8 July 2026).
- Snyk (2018) A post-mortem of the malicious event-stream backdoor. Available at: https://snyk.io/blog/a-post-mortem-of-the-malicious-event-stream-backdoor/ (Accessed: 8 July 2026).
- Akamai (2024) XZ Utils Backdoor — Everything You Need to Know, and What You Can Do. Available at: https://www.akamai.com/blog/security-research/critical-linux-backdoor-xz-utils-discovered-what-to-know (Accessed: 8 July 2026).
- Rapid7 (2024) Backdoored XZ Utils (CVE-2024-3094). Available at: https://www.rapid7.com/blog/post/2024/04/01/etr-backdoored-xz-utils-cve-2024-3094/ (Accessed: 8 July 2026).
- Cybersecurity and Infrastructure Security Agency (2025) Supply Chain Compromise of Third-Party tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154). Available at: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction (Accessed: 8 July 2026).
- Wiz (2025) GitHub Action tj-actions/changed-files supply chain attack (CVE-2025-30066). Available at: https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066 (Accessed: 8 July 2026).
- MITRE ATT&CK (2025) Contagious Interview (Group G1052). Available at: https://attack.mitre.org/groups/G1052/ (Accessed: 8 July 2026).
- Socket (2025) North Korea’s Contagious Interview Campaign Escalates: 338 Malicious npm Packages. Available at: https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages (Accessed: 8 July 2026).
- The Hacker News (2026) GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension. Available at: https://thehackernews.com/2026/05/github-internal-repositories-breached.html (Accessed: 5 August 2026).
- Help Net Security (2026) TeamPCP breached GitHub’s internal codebase via poisoned VS Code extension. Available at: https://www.helpnetsecurity.com/2026/05/20/github-breached-teampcp/ (Accessed: 5 August 2026).
- Cyberhaven (2024) Cyberhaven’s Preliminary Analysis of the Recent Malicious Chrome Extension. Available at: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension (Accessed: 5 August 2026).
- The Hacker News (2024) Dozens of Chrome Extensions Hacked, Exposing Millions of Users to Data Theft. Available at: https://thehackernews.com/2024/12/16-chrome-extensions-hacked-exposing.html (Accessed: 5 August 2026).