ReversingLabs Reports 73% Rise in Malicious Open-Source Packages in 2025
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
ReversingLabs’ 2026 supply chain security report finds malicious open-source package detections rose 73% in 2025, with npm accounting for nearly 90%. Developer secrets exposure increased 11%, while PyPI malware detections fell 43%.
Key points
- ReversingLabs detected 10,819 malicious npm packages in 2025, up from 5,290 in 2024, accounting for nearly 90% of its open-source malware detections.
- Malware detections fell 43% on PyPI and 60% on NuGet. The report suggests stronger authentication and trusted publishing may have contributed, but does not establish causation.
- Exposed developer secrets increased 11% across npm, PyPI, NuGet, and RubyGems; npm and PyPI accounted for roughly 95% of detected leaks.
- Two Shai-hulud campaigns compromised close to 1,000 npm packages, combining stolen credentials, secrets theft, private-repository exposure, and automated propagation.
- Maintainer phishing, malicious pull requests, and automated dependency updates demonstrated how attackers could turn trusted development workflows into malware distribution channels.
- The report documents threats targeting AI development, including malicious Pickle model files that evade scanning and infostealer payloads hidden inside PyTorch models.
- Drawing on public reports and anonymized ReversingLabs analysis, the study recommends continuous software inspection, reproducible builds, verified trust chains, and security monitoring across development pipelines.
Article Details
- Publisher
- ReversingLabs
- Report Period
- 2025-01-01 to 2025-12-31
- Scope
- Software supply chain threats across open-source repositories, commercial software, development pipelines, and AI ecosystems, using public reporting and anonymized ReversingLabs analysis.
- Key Statistics
- ReversingLabs reports a 73% increase in malicious open-source package detections in 2025 compared with 2024.
- npm malware detections increased from 5,290 in 2024 to 10,819 in 2025, representing 89.7% of ReversingLabs' open-source malware detections in 2025.
- PyPI malware detections declined from 1,575 in 2024 to 891 in 2025, a reported decrease of 43%. The report does not establish a definitive cause.
- Detected developer-secret exposure increased 11% across npm, PyPI, NuGet, and RubyGems in 2025; npm and PyPI accounted for roughly 95% of detected leaks.
- According to Wiz Security, the second Shai-hulud wave in November exposed roughly 400,000 raw secrets through stolen data published in 30,000 GitHub repositories.
- Recommendations
- Continuously inspect and validate software throughout development, build, and deployment, using reproducible builds and verified trust chains.
- Assess open-source packages and extensions before incorporation, and inspect proprietary binaries for tampering and malicious behavior before publication or deployment.
- Strengthen maintainer-account and publishing security through mandatory multifactor authentication and trusted publishing.
- Use multiple vulnerability-intelligence sources rather than relying exclusively on NVD.
- Vet Pickle model files for threats as executable software, and establish enterprise governance and controls for unsanctioned AI use.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationCompromised npm packages contained heavily obfuscated malicious JavaScript designed to steal cryptocurrency funds.T1036.008 · Masquerade File TypeA malicious VS Code extension operation concealed an archive containing malicious binaries as an image with a PNG extension.T1078 · Valid AccountsShai-hulud used stolen credentials to access npm developer accounts and publish infected packages; Salt Typhoon also used stolen credentials to maintain network access.T1190 · Exploit Public-Facing ApplicationReported intrusions exploited unpatched firewall and network-device vulnerabilities to gain access to critical infrastructure and telecommunications networks.T1195.001 · Compromise Software Dependencies and Development ToolsAttackers compromised upstream packages, maintainer accounts, and development dependencies to distribute malicious updates downstream.T1552.001 · Credentials In FilesShai-hulud deployed TruffleHog to find secrets and exposed private repositories containing hardcoded credentials.T1566.002 · Spearphishing LinkMaintainer phishing emails used links to an imitation npm website, including a tokenized URL, to facilitate account compromise.T1572 · Protocol TunnelingAttackers configured GRE tunnels on compromised routers to exfiltrate data while blending with legitimate network traffic.
CVE
People
Donald StufftPyPI administrator cited explaining trusted publishing with short-lived identity tokens.Josh JunonDeveloper using the handle ~qix whose npm maintainer account was compromised through a phishing email posing as a 2FA message.Joun QinMaintainer using the handle ~jounqin whose account compromise enabled malicious eslint-config-prettier releases.Karlo ZankiReversingLabs researcher who identified the NullifAI technique and malicious packages targeting AI and Solana developers.Lucija ValentićReversingLabs researcher who discovered a VS Code Marketplace extension-naming loophole.Mario VuksanReversingLabs CEO and co-founder who introduced the report and advocated continuous software validation.Mike FielderPyPI administrator and safety and security engineer quoted on the disruption caused by removing compromised projects.Petar KirhmajerReversingLabs threat researcher who investigated malicious VS Code extensions, including a set of 19 extensions hiding malware in dependency folders.Tomislav PeričinReversingLabs chief software architect and co-founder quoted on maintainer compromise, supply chain controls, and MCP security risks.Vladimir PezoReversingLabs researcher who detailed command-jacking risks involving PowerShell Gallery module installation.
Threat Actors
Airez299Attacker handle associated with a malicious GitHub pull request that compromised the ETHcode extension.APT 38Presented as an alternate name for Lazarus Group in discussion of nation-backed cryptocurrency attacks.Banana SquadPosted more than 60 GitHub repositories containing trojanized look-alikes of legitimate security and penetration-testing tools.BrickstormDescribed by the report as a China-linked group that compromised F5 Networks and stole BIG-IP source code and engineering documentation.Lazarus GroupNamed as a nation-backed actor targeting cryptocurrency wallets; the report identifies APT 38 as an alternate name.Salt TyphoonDescribed as a China-backed group targeting critical infrastructure and telecommunications; reportedly used CVE-2018-0171, stolen credentials, and living-off-the-land techniques.Volt TyphoonDescribed as a China-backed group repeatedly targeting critical infrastructure in the United States and other countries for persistent access.
Malware
Vendors
Ciscoflaw in Cisco’s IOS XE software to implant maliciousCrowdStrikepublishers, with several npm packages from endpoint detection vendor Crowdstrike compromised10, asF5 Networkscompromised F5 Networks and stole source codeGitHuband the manipulation of GitHub Actions. TheseMicrosoftVS Code Marketplace, a Microsoft platform thatPostHogwell as packages managed by workflow automation vendor Zapier, development tools vendor PostHog,ReversingLabs©2026 ReversingLabs, Inc. — All Rights ReservedTRUST DELIVEREDTrust WalletOn December 30, for example, the cryptocurrency wallet vendor Trust Wallet disclosed that a hack of itsZapierwell as packages managed by workflow automation vendor Zapier, development tools vendor PostHog,
Products
BIG-IPfrom the BIG-IP product development environment,Cisco IOS XEflaw in Cisco’s IOS XE software to implant maliciousETHcodeVS Code extension, ETHcode, that was originally intended for Ethereum smart-contract development.GitHub Actionsand the manipulation of GitHub Actions. TheseHugging FaceHugging Face’s Rise Comes with Pricenpmof detections concentrated in npm. Even moreNuGetmonitors: npm, PyPI, NuGet, and RubyGems. Exposed developer secrets rose 11% across majorPowerShell GalleryPowerShell Gallery Abuse Targets Dev ProcessesPyPIplatforms like Python Package Index (PyPI).RubyGemsmonitors: npm, PyPI, NuGet, and RubyGems. Exposed developer secrets rose 11% across majorVS CodeVS Code Threats MultiplyVS Code Marketplacemonitored repositories: npm, PyPI, RubyGems, NuGet, and the VS Code Marketplace.
Tools
DependabotAutomating Insecurity: Dependabot and Maintainer HacksPicklescanby Picklescan, an open-source tool used by Hugging Face to detect suspicious PKL files. The NullifAIRenovateThe incident highlights how trusted automation tools such as Dependabot and Renovate, which areTruffleHogThen, in September, the Shai-hulud worm campaign on npm deployed TruffleHog, an open-source