Software Supply-Chain Malware Trends: January–May 2026
Summary
An analysis of malicious-package reports through May 18, 2026, finds similar growth in npm and PyPI malware, rising account-takeover activity, and malicious ClawHub skills targeting varied groups.
Key points
- The analysis covers malicious software-supply-chain activity from January 1 to May 18, 2026, drawing on a database of more than 166,000 threat records.
- The database recorded 146,237 malicious npm packages and 10,940 PyPI packages; both ecosystems grew steadily, with PyPI growing faster relative to its smaller base.
- The article attributes activity in both ecosystems to campaigns including Contagious Interview and an unattributed Telegram infostealer cluster; the largest single-week npm increase was linked to Stardrop.
- Account takeovers remained below 10% of weekly reports for most of Q1, then rose during TeamPCP campaigns, including Mini Shai-Hulud. The article cautions that ATO-focused defenses may not address dependency confusion or typosquatting.
- Mini Shai-Hulud accounted for 64% of malicious packages with more than 10,000 weekly downloads and 84% of those with more than one million, according to the analysis.
- Researchers analyzed 707 malicious ClawHub skills. Target groups included crypto and finance (32%), social media and marketing (19%), CLI impersonations (17%), productivity (16%), and developers (12%).
Article Details
- Publisher
- OpenSourceMalware
- Report Period
- 2026-01-01 to 2026-05-18
- Scope
- Malware trends across open-source package ecosystems, account takeovers, and malicious ClawHub skills.
- Sample Size
- 707 malicious ClawHub skills analyzed; the publisher reports more than 166,000 threats in its database.
- Key Statistics
- The database contained 146,237 npm threat records, 10,940 PyPI records, and 4,239 records across other package types.
- Of 707 malicious ClawHub skills analyzed, 32% targeted crypto/finance, 19% social media/marketing, 17% CLI impersonations, 16% productivity, 12% developers, and 4% were unclassified.
- TeamPCP was attributed 64% of malicious packages with over 10,000 weekly downloads and 84% of those in the 1M+ weekly-download tier.
- Paul McCarty discovered 386 malicious ClawHub skills between January 27 and February 22; the count exceeded 700 by the end of March.
People
Threat Actors
Products
Axiosas many people as possible, which is why ATOs usually target packages with high downloads. The `axios` package (attacker unknown) was one of the biggest ATOs this year because it averages 108.4 million weeklyClawHubMalicious ClawHub skills targeted diverse victimsNode.jsdownload numbers. For example, `events-channel` is a sophisticated npm package that mimics the popular Node.js 'events' module.npmnpm and PyPI malware are growing at similar ratesOpenClawhe was right. Between January 27-February 22, he discovered 386 malicious skills in ClawHub (OpenClaw’s skill registry). By the end of March, that number topped 700.PyPInpm and PyPI malware are growing at similar ratesTrivywhich is fair since TeamPCP pulled off lots of high-profile ATOs beginning with the March compromise of Trivy and growing with their successful Mini Shai-Hulud campaign. But the buzz around ATOs is also dangerous