Malware Reaches 845K Packages | Sonatype OSS Malware Index

▤ Summary

Sonatype released its Q2 2025 Open Source Malware Index and reported 16,279 malicious open source packages across ecosystems such as npm and PyPI. The company said its total detected malware count has reached 845,204, with attacks rising sharply year over year. The report highlights data exfiltration as the dominant threat, along with growth in data corruption malware and continued cryptomining activity. Sonatype also pointed to Lazarus Group activity and positioned Repository Firewall as a defense against malicious packages and AI models.

▦ Linked Companies