Security & Threat Intelligence · 25.07.2026, 15:29 UTC
Q2 2026 Open Source Malware Index
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | Sonatype ↗ |
| Veröffentlicht | 25.07.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
TL;DR At the end of Q2 2026, Sonatype Research reached 1.8 million malicious packages logged. In Q2, npm accounted for 96.6% of malicious package counts, with repository abuse and trojan-class activity showing how attackers continue to exploit high-trust, high-automation ecosystems. The quarter's defining theme was trust under pressure. Large-scale repository abuse campaigns, worm-like malware, dependency confusion, and maintainer compromises turned trusted software distribution channels into attack paths. Q2 showed attackers evolving beyond obvious malicious packages to target trusted developer workflows through campaigns like Shai-Hulud Miasma, CanisterSprawl, Atomic Arch, malicious PyTorch Lightning releases, dependency confusion, and maintainer/package hijacking. In Q2 2026, Sonatype Research reached more than 1.8 million malicious packages logged across ecosystems over the past decade. This quarter's malicious activity was driven overwhelmingly by npm, which accounted for 96.6% of packages. This quarter was not shaped primarily by isolated malicious uploads, but rather a more industrialized pattern of abuse, for example: Large-scale package publication Repository misuse Trojan-class malware operating at massive volumes npm's dominance should not flatten the story. Sonatype also observed lower-volume but higher-signal malicious behavior across PyPI, NuGet, Hugging Face models, RubyGems, Go, Cargo, and other ecosystems. So, npm produced the flood, but the broader ecosystem showed how attackers continue to probe trusted developer workflows. …