The Software Supply Chain Malware Landscape: January - May 2026

What it is

OpenSourceMalware's landscape report (Jan 1–May 18, 2026) drawing on 166,000+ tracked malicious-package records across 16 ecosystems. Beyond the raw ecosystem counts, its useful payload for a defender is a mapping between attack vector and which mitigations actually work — and a warning that the current attention on account takeovers (ATOs) misleads defense investment.

How it works

The report separates two distinct threat classes and ties each to a defense:

• ATOs — legitimate packages compromised via maintainer-account or pipeline takeover. The attacker inherits the publisher's reputation, download history, and dependency-tree position. Because more eyes watch popular packages, malicious versions get pulled fast, so ATOs favor high-download targets (e.g. axios, ~108.4M weekly downloads, attacker unknown). TeamPCP drove these: the March Trivy compromise, then Mini Shai-Hulud.
• Dependency confusion / typosquatting — attacker-authored packages, often "born bad" (all versions malicious, like Stardrop) or benign-then-weaponized. These target specific tech (frequently crypto) and carry low download counts. events-channel mimics Node's events module.

The report uses download count as an imperfect proxy for vector: high downloads → likelier ATO. It notes that ATO-focused defenses — cooldown periods and dependency pinning — are useless against dependency confusion/typosquatting, which is the actionable crux.

What to do

Match controls to vector rather than to headlines:

• Cooldown periods and dependency pinning blunt ATOs but not typosquats/confusion; pair them with name-similarity checks, private-registry scoping, and per-package review for low-download crypto-adjacent dependencies.
• Treat the ATO surge as concentrated, not general: 64% of malicious packages with >10k weekly downloads (rising to 84% at the 1M+ tier) from late April were TeamPCP/Mini Shai-Hulud. Prioritize monitoring of your highest-download direct dependencies for unexpected new versions.
• If you consume AI skill registries, treat them as an active malware ecosystem now: 700+ malicious ClawHub skills by end of March (386 found Jan 27–Feb 22), delivering payloads either inline or via typosquatted domains.

Caveats

• ATO classification rests on "direct attribution tags and confirmed campaigns," and download count is stated as an "imperfect-but-decent proxy" — vector labels are inferential, not certain.
• ATOs sat below 10% of weekly reports for most of Q1; the surge is a spike driven by two named campaigns, so the report's own data says ATOs remain a minority of newly discovered malicious packages even while dominating the high-download tier.
• The Telegram-exfiltration infostealer cluster is unattributed; the Chinese-language package subset is described as suggesting a targeting focus, not confirmed.