Q1 2026 Open Source Malware Index: Adaptive Attacks, Familiar Weaknesses
None
<div class="hs-featured-image-wrapper"> <a href="https://www.sonatype.com/blog/q1-2026-open-source-malware-index" title="" class="hs-featured-image-link"> <img decoding="async" src="https://www.sonatype.com/hubfs/blog_osmiQ12026.jpg" alt="Q1 2026 Open Source Malware Index: Adaptive Attacks, Familiar Weaknesses" class="hs-featured-image" style="width:auto !important; max-width:50%; float:left; margin:0 15px 15px 0;"> </a> </div><h2 style="font-size: 30px; font-weight: normal;">TL;DR</h2><ul> <li> <p>Sonatype identified 21,764 open source malware packages in Q1 2026, bringing the total logged since 2017 to 1,346,867.</p> </li> <li> <p>npm accounted for 75% of malicious packages this quarter. Trojans dominated, with most activity focused on credential theft, host reconnaissance, and staged payload delivery.</p> </li> <li> <p>The quarter’s defining pattern was trust abuse: attackers succeeded by hiding behind trusted packages, trusted release paths, and trusted workflows.</p> </li> <li> <p>Three incidents stood out: SANDWORM_MODE, the LiteLLM compromise, and the axios compromise.</p> </li> </ul><h2 style="font-size: 30px; font-weight: normal;">By the Numbers: What We Saw</h2><p>In the first three months of 2026, Sonatype identified 21,764 open source malware packages across ecosystems, bringing the total number logged since 2017 to 1,346,867. Q1 activity was heavily concentrated in npm and focused on credential theft, host information exfiltration, and staged follow-on compromise.</p><p>The quarter was also defined by trojan-style malware, which outpaced brandjacking and hijacking as the dominant payload type. While access paths varied — typosquatting, maintainer compromise, and abuse of legitimate release channels — the pattern was consistent: attackers kept finding ways to push malware through software that looked legitimate enough to trust by default.</p><p>Three incidents illustrate that pattern especially clearly:</p><ul> <li> <p><a href="https://guide.sonatype.com/vulnerability/sonatype-2026-000542" style="text-decoration: none; font-weight: normal;">SANDWORM_MODE</a><span>, which pointed to more adaptive and worm-like malware behavior.</span></p> </li> <li> <p>Th<span style="text-decoration: none;">e </span><span style="font-weight: normal;"><a style="text-decoration: none;"></a><a href="https://guide.sonatype.com/component/golang/github.com%2Faquasecurity%2Ftrivy/v0.69.4/vulnerabilities?severities=critical" style="text-decoration: none;"></a><a href="https://guide.sonatype.com/component/golang/github.com%2Faquasecurity%2Ftrivy/v0.69.4/vulnerabilities?severities=critical" style="text-decoration: none;">Trivy</a><span style="text-decoration: none;">/</span><a href="https://guide.sonatype.com/vulnerability/sonatype-2026-001357" style="text-decoration: none;">litellm</a><span style="text-decoration: none;">-lin</span>ked campaign</span><span>, which showed how release paths and high-value AI and security tooling can become the attack surface.</span></p> </li> <li> <p>T<span style="text-decoration: none;">he </span><span style="font-weight: normal;"><a style="text-decoration: none;"></a><a href="https://guide.sonatype.com/component/npm/axios/1.14.1" style="text-decoration: none;"></a><a href="https://guide.sonatype.com/component/npm/axios/1.14.1" style="text-decoration: none;">axios</a><span style="text-decoration: none;"> comp</span>romise</span><span>, which demonstrated how a small dependency change inside a highly trusted package can create outsized downstream risk. </span></p> </li> </ul><p><span style="color: #ff00ff; white-space-collapse: preserve;"></span></p><h2 style="font-size: 30px; font-weight: normal;">Beyond the Numbers: Trust Abuse Was the Defining Pattern</h2><p>Q1 saw one new malicious package every six minutes, a<span style="text-decoration: none;">nd </span><a href="https://www.sonatype.com/blog/sonatype-discovers-two-malicious-npm-packages" style="text-decoration: none;"><span style="color: #1155cc;">npm</span></a><span style="text-decoration: none;"> acc</span>ounted for 75%, reinforcing that attackers still see JavaScript ecosystems as the fastest path to developers and build systems at scale. The prevalence of trojans far showed attackers did not need especially novel <a href="https://www.sonatype.com/blog/q1-2026-open-source-malware-index">(Read more...)</a></p><p class="syndicated-attribution">*** This is a Security Bloggers Network syndicated blog from <a href="https://www.sonatype.com/blog">2024 Sonatype Blog</a> authored by <a href="https://securityboulevard.com/author/0/" title="Read other posts by Sonatype Security Research Team">Sonatype Security Research Team</a>. Read the original post at: <a href="https://www.sonatype.com/blog/q1-2026-open-source-malware-index">https://www.sonatype.com/blog/q1-2026-open-source-malware-index</a> </p>