FlagThis

Abstract

In 2025, software supply chains transitioned into a primary attack surface for both cybercriminals and state-sponsored actors seeking scale and persistence. ReversingLabs observed a 73% increase in malicious open-source packages, with nearly 90% of detections concentrated in the npm registry. This shift represents a move beyond simple typosquatting toward the exploitation of trusted infrastructure, CI/CD workflows, and emerging AI/ML ecosystems, necessitating a fundamental move from implicit trust to continuous validation.