Sonatype Counts 454,600 New Malicious Packages in 2025 — And AI Coding Agents Widen the Risk

The Facts

Sonatype's 2026 State of the Software Supply Chain report documents one of the most alarming security trends in modern software development: throughout 2025, Sonatype identified more than 454,600 new malicious packages in public software repositories, taking its cumulative count of known and blocked malware past 1.233 million packages. Sonatype describes the shift as one from spam and stunts to sustained, industrialised campaigns against the people and tooling that build software.

A high-profile incident illustrating the real-world impact occurred when the Axios HTTP library — one of the most downloaded npm packages globally, with hundreds of millions of downloads — was compromised when malicious versions were published to the npm registry from a hijacked maintainer account. The malicious versions deployed a Remote Access Trojan (RAT) to affected systems, demonstrating that even widely-used, well-maintained packages are not immune to supply chain compromise.

For context on the scale: npm, PyPI, and other public package registries host hundreds of millions of package versions collectively. Developers building modern software depend on hundreds of these packages as dependencies — with each dependency introducing potential supply chain risk. A malicious package installed as an indirect dependency of a dependency can be extremely difficult to detect.

Technical Deep-Dive

Supply chain attacks in software repositories exploit the trust developers place in publicly available packages. The attack vectors include: typosquatting (publishing packages with names similar to legitimate packages to catch developers who mistype), dependency confusion (registering packages with the same names as internal company packages in public registries), account compromise (accessing a legitimate package maintainer's account to publish malicious updates), and direct injection (inserting malicious code into package contributions through the open-source contribution process).

AI has dramatically reduced the sophistication required to execute typosquatting and fake package attacks. An AI coding tool can generate a convincing README, package documentation, and plausible implementation code for a package designed to look like a legitimate utility while containing embedded malicious functionality. The barrier to creating a convincing fake package has fallen from "skilled developer with obfuscation expertise" to "anyone who can describe what they want."

Dependency auditing tools — npm audit, pip-audit, and specialised supply chain security platforms — scan installed packages against known vulnerability and malicious package databases. Automated integration of these tools in CI/CD pipelines (running on every build rather than periodically) is the baseline defence against known malicious packages.

The ASEAN Perspective

ASEAN's rapidly growing developer community is disproportionately exposed to supply chain risk for two structural reasons. First, the adoption of open-source packages and modern development frameworks has accelerated faster than security practices — many development teams in the region are using hundreds of open-source dependencies without systematic security scanning. Second, the security tooling and practices that are standard in US and European enterprises are often absent in ASEAN SMEs and startups.

Singapore's Cyber Security Agency has been publishing guidance on software supply chain security, and larger Singapore technology companies (including government-linked entities) have implemented supply chain security scanning as standard practice. The gap between Singapore's leading enterprises and ASEAN's broader startup and SME ecosystem is substantial.

For ASEAN developers, the practical response to the supply chain threat is straightforward: add pip-audit or npm audit to CI pipelines, review all dependency additions carefully, and consider using private package mirrors for production builds that have been pre-scanned.