Shadow downloads – How developers have become the new perimeter
Summary
And one of the most invisible, yet growing risks in modern software development is the shadow download and the rise of malicious open source packages designed to exploit it. A shadow download happens when a developer or build tool pulls a package directly from a public open source registry, bypassing the organizations secure internal repository or proxy. Package managers like npm, pip, and Maven were built for speed and convenience — and this "direct from the source" model was the norm. But even with repositories in place, shadow downloads still happen, often silently: • Developers may not realize the repo exists so they continue to go directly to the public registry for local builds. Here are just a few real-world incidents: • pygrata-utils: A fake Python utility that exfiltrated AWS credentials, SSH keys, and .gitconfig contents on install.