Open-source malware targets data exfiltration
Supply chain security company Sonatype has released the Q2 2025 edition of its Open Source Malware Index, uncovering 16,279 malicious open source packages across major ecosystem.
This brings the total number of open-source malware packages Sonatype has discovered to 845,204. Compared to the end of the same quarter last year, the total volume of malware logged by Sonatype has surged 188 percent, underscoring the growing sophistication and scale of attacks aimed at developers, software teams, and CI/CD pipelines.
"Attackers are no longer simply experimenting with open source. The numbers are telling us that threat actors have identified data as the most profitable target, and developers as the easiest way in," says Brian Fox, CTO and co-founder of Sonatype. “Developers and security teams must be vigilant, as threats increasingly hide in plain sight within everyday tools and dependencies.”
Data exfiltration remains the main motivation, accounting for 55 percent of all malicious packages discovered. In Q2 alone, more than 4,400 packages were specifically designed to steal sensitive data, including secrets, personally identifiable information (PII), passwords, access tokens, and API keys. These attacks increasingly target the critical intersection of developer tools and production environments, where a single leak can compromise entire systems.
There’s also been an increase in malware focused on data corruption, with these threats doubling in frequency to represent over three percent of all malicious packages -- more than 400 unique instances in Q2 2025. These packages aim to damage files, inject malicious code, or otherwise sabotage applications and infrastructure. By contrast cryptominers have declined, making up only five percent of packages in Q2.
The report shows that sophisticated threat groups are using open source to accomplish cyber espionage, financial cybercrime, and more. For example, Lazarus Group, an Advanced Persistent Threat (APT) associated with the North Korean government, has been associated with 107 packages discovered by Sonatype in Q2 2025 that collectively have more than 30,050 known downloads.
You can find out more on the Sonatype blog.
Image credit: solarseven/depositphotos.com