Sonatype's ongoing mission is to equip organizations with the most up-to-date information on open source security threats. As part of that commitment, we will be sharing data and insights on a quarterly basis, diving into how the open source malware space is evolving, including diving into notable malicious packages.
The proliferation of open source malware, or malicious open source packages, poses unprecedented risk in the form of software supply chain attacks. Unlike vulnerabilities, which are accidental coding errors, open source malware is intentionally crafted to target developers in order to infiltrate and exploit software supply chains. A uniquely hidden and pervasive threat, open source malware is designed to trigger on load, before application scanning would detect it, and traditional endpoint security products are unable to detect open source malware signatures.
Q1 2025 at a glance
From January 1 through March 31, Sonatype uncovered 17,954 pieces of open source malware. The Q1 figure represents a significant decrease from the over 34,000 malicious packages discovered last quarter — this is largely due to the marked decrease in security holdings packages. When comparing Q1 2025 to the same time last year, the overall malware count more than doubled.
Over half (56%) of the malware discovered in Q1 2025 was related to data exfiltration, designed to collect sensitive information from infected systems. This is a dramatic increase from just 26% in Q4 2024. This rise highlights the growing concern of sensitive information being compromised via malicious open source components. Crypto-mining malware made up 7% of malicious packages discovered in Q1 2025 — up from just 3.5% in Q4 2024 — showing that resource-hijacking attacks are still prevalent in open source ecosystems.
-png.png?width=961&height=1971&name=Malware%20index%20Q1%202025-vertical%20(3)-png.png)
Notable discoveries
Hijacked npm crypto packages
In a coordinated attack, several popular crypto-related npm packages were hijacked and republished with malicious payloads designed to steal sensitive information. These repackaged libraries maintained their original functionality to avoid detection but secretly exfiltrated data including environment variables, user profiles, directory listings, and even system information.
What makes this campaign particularly insidious is the attackers’ strategic focus on packages used in cryptocurrency and blockchain development, where credentials and secrets are often highly valuable. Malicious versions appeared to originate from a single threat actor, with overlapping infrastructure and obfuscation techniques suggesting a calculated and sustained effort.
For developers relying on these packages, this incident serves as a sharp reminder of the risks posed by software dependencies and underscores the need for real-time malware detection in the software supply chain.
Truffle for VS Code
Another recent discovery exposed a deceptive npm package masquerading as a Visual Studio Code extension, which covertly deployed a modified version of the remote desktop tool ScreenConnect to conduct surveillance. The package posed as a legitimate development utility but contained an obfuscated binary that installed the remote access software without user consent.
The repurposed ScreenConnect binary granted attackers covert access to infected machines, enabling full remote control, screen monitoring, and data exfiltration. Unlike many malware strains that rely on script-based payloads, this attack embedded a compiled binary, making it harder to detect through casual inspection.
This incident highlights an emerging trend where legitimate administrative tools are weaponized for espionage under the guise of harmless developer packages — a tactic that blurs the line between utility and threat in the software supply chain.
Fake solana packages
In another recent software supply chain attack, npm packages targeted Solana cryptocurrency developers. These packages, downloaded over 1,900 times collectively, contained Windows-based trojans capable of keylogging and exfiltrating sensitive data.
Notably, the malicious code was not obfuscated, making its intent overt. Upon installation, these packages executed PowerShell scripts that logged keystrokes and took screenshots, abusing Slack webhooks and the ImgBB API to transmit the collected data to external servers.
This incident underscores the persistent threats within open source, particularly targeting the cryptocurrency development community. Developers need to exercise heightened vigilance when integrating third-party packages, especially those related to financial technologies, and to implement robust security measures to detect and prevent such malicious activities.
Open source malware blocked by Sonatype
From hijacked crypto packages to fake development tools laced with spyware, Q1 2025 made it clear that open source malware threats are growing in both scale and sophistication. Threat actors continue to target the open source ecosystem with campaigns designed to steal credentials, exfiltrate sensitive data, and establish persistent access inside developer environments.
While many of these threats are engineered to bypass traditional detection tools, users of Sonatype Repository Firewall remain protected. With near real-time detection powered by machine learning and behavioral analysis, Sonatype Repository Firewall automatically blocks known and emerging malware before it ever reaches your development pipeline. Since 2019, Sonatype has identified and blocked over 100,000 malicious packages and counting.
To keep your software supply chain secure from end to end, consider pairing Sonatype Repository Firewall with Sonatype Lifecycle to ensure continuous monitoring, policy enforcement, and governance of open source dependencies throughout the SDLC.
Stay tuned for more insights in our next quarterly update and stay vigilant. The threats are evolving, but so are the tools to stop them.
