Malware in open source software is no longer a fringe threat–it's accelerating at an unprecedented rate. In 2025 alone, more than 90% of open source vulnerability (OSV) malware advisories were reported, a 14-times increase over the past two years, while 92% of npm account takeovers (where maintainers of trusted open-source software (OSS) projects are compromised) also occurred last year, according to "Malware in Open Source Ecosystems,” produced by Endor Labs.
"Most application security programs were built around vulnerability management, not to detect malware in the software supply chain. Attackers understand this. AI coding agents, MCP servers, and model dependencies are creating new entry points, and we're already seeing an uptick in malware in open source ecosystems targeting AI coding agents," says Varun Badhwar, CEO of Endor Labs. "The gap between how fast attackers move and how fast organizations respond is widening, and without a coordinated, cross-functional approach, even strong controls fail in practice."
Key takeaways:
· Despite widespread recognition of the threat, with 81% of organizations naming OSS malware a top security priority, only 21% enforce protections like cooldown periods, leaving attackers a widening window to exploit the software supply chain.
· Organizations are treating OSS malware as isolated incidents rather than a coordinated security challenge.
· While most understand the urgency (88% say the first few days after a package release are the riskiest), few take effective action, leaving their environments vulnerable to attackers who are increasingly hijacking trusted packages.
- Malicious OSS surged in 2025, with advisories issued faster than organizations can respond. Even short-lived malicious versions can be automatically pulled into thousands of environments within hours.
- Organizations understand the risk, yet fewer than half plan to increase budgets for 2026.
- Many compromised packages remain downloadable even after being reported. Only 14% of previously compromised npm packages use modern security controls like Trusted Publishing. Fragmented responsibility across teams further increases exposure.
