Open-Source Software Malware Surging: Endor Labs

Why It Matters

The rapid rise in OSS malware threatens the integrity of millions of applications and can compromise critical business data, forcing companies to rethink supply‑chain defenses. Without coordinated controls, the speed advantage of attackers will continue to outpace organizational response.

Key Takeaways

• 2025 saw 14× rise in OSS malware advisories.
• 92% of NPM account takeovers occurred in 2025.
• Only 21% enforce cooldown periods for package updates.
• 14% of compromised NPM packages use Trusted Publishing.
• AI coding agents create new OSS malware entry points.

Pulse Analysis

The surge in open‑source software malware reflects a broader shift in cyber‑threat dynamics, where attackers exploit the very building blocks of modern applications. In 2025, more than 90% of OSV malware advisories were logged, a 14‑times jump from two years earlier, and NPM account takeovers spiked to 92% of the total incidents. These figures underscore how the open‑source ecosystem, prized for its speed and collaboration, has become a fertile hunting ground for malicious actors targeting supply‑chain vulnerabilities.

Despite the alarming statistics, many enterprises remain ill‑prepared. While 81% of organizations identify OSS malware as a top priority, only 21% enforce basic safeguards such as cooldown periods that delay automatic package updates. Structural weaknesses persist: merely 14% of compromised NPM packages now leverage Trusted Publishing or similar modern controls, and budget allocations for 2026 security enhancements lag behind the threat curve. This awareness‑action gap leaves critical software stacks exposed, especially as compromised packages can propagate across thousands of environments within hours.

Looking ahead, the convergence of AI coding agents, model‑driven development pipelines, and increasingly sophisticated malware will intensify the risk. Companies must adopt a cross‑functional, supply‑chain‑centric security model that blends real‑time monitoring, automated remediation, and strict publishing standards. Investing in proactive defenses—such as mandatory cooldown windows, cryptographic signing, and continuous provenance verification—will be essential to narrow the attacker‑defender speed gap and protect the integrity of the software that powers today’s digital economy.