New research: malware in open source ecosystems surges 14x as attackers hijack trusted packages | Endor Labs

What it is

Endor Labs' report "Malware in the Open Source Ecosystem" combines a survey of 605 IT professionals (closed early February) with its own analysis of OSV advisories and npm metadata. The page is a vendor summary, so the figures below come from Endor Labs and are not independently checked.

How it works

Two attack patterns are described in more detail than the existing summary gives.

• Account takeover (ATO): the attacker steals a maintainer's credentials and publishes a malicious version under the trusted package name.
• Credential chaining (TeamPCP): the campaign began with one incomplete incident response at Aqua Security in late February. Within 30 days it spread across GitHub Actions, Docker Hub, npm, OpenVSX and PyPI. Each compromise yielded credentials for the next target: Trivy and KICS, then litellm (95 million monthly downloads), then telnyx three days later.
• axios: the attacker hijacked a maintainer account and added a postinstall hook that pulls in a typosquatted package. The attack relies on automated pipelines to spread it before anyone notices. The page attributes it to a North Korea-linked group, different from TeamPCP.

Preconditions / Affected

Among the 930 npm ATO advisories filed in 2025:

The page says attackers deliberately target packages embedded in production systems and CI/CD pipelines. Exposure is therefore highest for anything that installs dependencies automatically on release.

What to do

The page gives no commands or configuration. Its implied actions are:

• Enforce a cooldown period for newly released package versions. 88% of respondents know the first days after release are the riskiest, but only 21% enforce one.
• Name a single owner for malicious-OSS response. Responsibility is split across engineering, AppSec, cloud security and SecOps.
• Give SecOps and IR visibility into dependency intake controls. Those respondents were 2x more likely to report having none, even though they are called when an incident occurs.
• Measure containment time. 31% of organizations can triage and contain a malicious package within hours, while 26% need two days or more. That window is enough to exfiltrate credentials and harvest secrets.

Caveats

• The survey closed in early February, and the TeamPCP and axios events came after it. The page does not tie the survey findings to them.
• The "12x" and "90%" figures count advisories filed in OSV. They may partly reflect more reporting and not only more attacks, and the page does not discuss this.
• Other survey figures: 81% call malicious OSS a top priority, only 48% expect spending on prevention and detection to rise in 2026, and 51% found suspected or confirmed malicious packages in 2025.