The State of Open Source Supply Chain Attacks

What it is

A StepSecurity threat-intelligence report quantifying malicious open-source supply chain compromises across npm, PyPI, RubyGems, Composer, and crates.io from August 2025 through August 2026. The summary lists the incidents; the report's real payload is its counting methodology and a defensive argument about where malicious code must be caught.

What actually counts (and why it matters)

The 56 figure is deliberately narrow, and the exclusions are the point:

• Malicious code only, never vulnerabilities. CVEs and SCA-style "flaw that might be exploited later" cases are excluded. A malicious package runs the moment it installs.
• Typosquats, name-confusion, and lookalikes are excluded. The 56 all target components an ecosystem already trusted — the attacker compromises the next version of a trusted package, or silently repoints tags (as GitHub Actions allow), and rides existing trust into thousands of builds.

The operational takeaway: SCA and production monitoring are structurally too late for this class of attack. By the time a malicious dependency reaches production, it has already executed on a developer laptop or CI runner and the credentials are already exfiltrated. Detection has to happen at install / build time.

flowchart LR
    A[Trusted package/Action] -->|next version or tag repoint| B[Malicious code ships]
    B --> C[Installs on laptop / CI runner]
    C --> D[Credentials stolen immediately]
    D -.too late.-> E[Reaches production / SCA looks here]
    C -->|worm: reuses stolen token| A

The worm loop

Self-propagation is the named driver of the 8x jump. A worm reuses a victim's stolen publish token to infect every package that maintainer controls, then repeats downstream — turning one phished maintainer into an ecosystem-scale event (Shai-Hulud: 500+ packages).

Team PCP specifics

The five-day campaign (March 19–24, 2026) adds detail beyond the summary:

• Trivy GitHub Action: 76 of its 77 version tags were poisoned.
• telnyx PyPI package: the credential stealer was hidden inside a WAV audio file.
• Also hit the Checkmarx KICS Action and LiteLLM. Victim dataset later published by CloudSEK.

Caveats

• Counts are StepSecurity's own alerting scope; a few incidents were Threat Center alerts with no standalone blog post. The figure is a floor for "trusted-component compromises," not a total for all registry malware.
• The report gives no patch commands or IOCs in this text — the actionable content is the detection-timing argument and the methodology, not a remediation checklist. Per-month totals and the final Team PCP victim numbers are referenced but the raw table/figures were truncated in the fetched text.