The malicious npm package, the typosquatted PyPI release, the compromised Docker image, the backdoored GitHub Action. The pattern has matured. The frequency has increased. The defence has not kept up. The open source supply chain in 2026 is, in aggregate, the most attacked layer of the software stack, and the defender who treats the open source dependency as trustworthy has accepted a risk the attacker has learned to exploit.
What the attack actually looks like in 2026
Five patterns, in roughly that order of frequency.
1. The typosquat. The malicious package has a name that is one character off from a popular package, or that uses a similar looking Unicode character. The developer installs the wrong package. The malicious package runs in the developer environment. The malicious package exfiltrates the developer environment variables, the developer .npmrc, the developer .aws/credentials.
2. The name confusion attack. The malicious package takes over a popular package that has been abandoned, or that the maintainer has been convinced to hand over. The maintainer hands over the package. The malicious package publishes a new version with a post install hook. The hook runs on every install. The hook exfiltrates.
3. The malicious GitHub Action. The action runs in the CI pipeline, on every commit, on every PR. The action has access to the secrets. The action exfiltrates the secrets.
4. The compromised maintainer account. The maintainer npm or PyPI account gets phished. The attacker publishes a new version of the legitimate package. The new version has the post install hook.
5. The typosquatted Docker image. The image name is similar to the official image. The image contains a backdoored binary. The image runs in the production environment. The image makes outbound connections to the command and control server.
What the defence looks like
Three moves, in priority order.
1. Pin and verify everything. The package versions, the container image digests, the GitHub Action SHAs. The pinning counts as the difference between the supply chain that uses the version the developer intended and the supply chain that uses whatever the upstream published last night. The verification sits as the check that the artifact has not been tampered with between the upstream and the build environment. Sigstore, SLSA provenance, the various software bill of materials tools. The defence is not free, and the defence is what the engineering team has to do.
2. Use a private package registry. The private registry runs as the registry that proxies the public registries, the private registry serves as the registry that enforces the allowlist, and the private registry sits as the registry that catches the typosquatted package before the package reaches the build. The private registry is not free, the private registry is what the platform team has to set up, and the private registry is what the engineering team has to integrate with. The private registry is what the engineering team has to do to make the public supply chain auditable.
3. Scan everything in CI. The vulnerability scanner, the secret scanner, the malware scanner, the SBOM generator. The scanning stands as the check that catches the malicious package after the package has been installed, and the scanning stands as the check the engineering team is going to have to add to the build pipeline. The scanning is not free, the scanning is what the security team has to configure, and the scanning is what the engineering team is going to have to triage.
What to do this quarter
Audit the top 20 dependencies. Look for the typosquats, the abandoned packages, the unmaintained packages. The audit is what the engineering team has been avoiding, and the audit is what the engineering team has to do. The audit takes a week, the audit produces the list of the dependencies the engineering team is going to have to replace, and the audit runs as the first step the engineering team is going to have to take to make the supply chain auditable.
Set up the private package registry. The private registry is what the platform team has to do, the private registry is what the platform team has to budget for, and the private registry is what the platform team has to ship this quarter. The private registry counts as the work that makes the public supply chain auditable, and the private registry is what the platform team is going to be glad the platform team did.
Wire the scanning into the CI pipeline. The scanning is what the security team has been wanting to wire in for years, the scanning is what the security team has to budget for, and the scanning is what the security team is going to have to integrate with the existing tooling. The scanning is what the security team is going to have to do to make the supply chain defensible.
The bottom line
The patterns the post covers have been showing up in production for long enough that the patterns have names, the failures, the mitigations, the gaps. The work the security team and the engineering team and the operations team are quietly doing today sits as the work that decides whether the practice the post names sits as a tool the team uses or a liability the team is paying for.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
