Notifications
Clear all
Topic starter
02/08/2026 12:12 pm
TL;DR: 2025 saw 206,632 packages flagged as critical malware, 1,062,697 packages using obfuscation, and 160,959 packages executing suspicious install code, according to Veracode Threat Research. The operational lesson is that dependency monitoring, build integrity, and secrets governance now need to be continuous, not periodic, while Shai-Hulud showed worm-like propagation through compromised NPM accounts and CI/CD paths.
NHIMG editorial — based on content published by Veracode: Dec 11, 2025 Threat Research Year In Review
Questions worth separating out
Q: What breaks when software supply chains rely on static package review alone?
A: Static review misses the behaviours attackers use most often, including install hooks, external payload fetches, obfuscated scripts, and credential theft from build systems.
Q: Why do compromised CI/CD credentials make supply chain attacks much worse?
A: CI/CD credentials often sit at the centre of publish, build, and deployment workflows, so one stolen token can reach many repositories and environments.
Q: How do security teams know whether package installation risk is under control?
A: Look for three signals: scripts are blocked or tightly governed during install, runner memory and local secrets are minimized, and package provenance is checked before deployment.
Practitioner guidance
- Constrain publish and build credentials Limit NPM, GitHub, and CI/CD tokens to the smallest possible scope, separate publish rights from build rights, and remove persistent access where ephemeral credentials will do the job.
- Inspect install-time behaviour, not just package contents Add detection for preinstall, install, and postinstall hooks, especially when they fetch code from external URLs or touch environment variables.
- Harden CI/CD with provenance and isolation Use isolated runners, signed artifacts, and build provenance checks so a compromised dependency or workflow cannot silently alter release outputs.
What's in the full report
Veracode's full year-in-review covers the operational detail this post intentionally leaves for the source:
- Per-campaign package naming patterns and indicators of compromise that help security teams tune detections.
- Detailed examples of malicious install hooks, obfuscated loaders, and exfiltration paths seen in 2025.
- The Shai-Hulud propagation chain, including how compromised authentication tokens were used to spread further.
- Veracode's 2026 predictions on build compromise, live provenance, and AI-driven supply chain attacks.
👉 Read Veracode's year-in-review on 2025 supply chain threats and 2026 predictions →
Software supply chain attacks in 2026: are your build controls keeping up?
Explore further
02/08/2026 1:15 pm
AI-assisted supply chain compromise is becoming an identity problem before it is a malware problem. The article shows attackers using installation hooks, obfuscation, and stolen credentials to move through trusted build paths. That means the decisive governance question is who or what is allowed to publish, build, and deploy under machine identity. Practitioners should treat package ecosystems as identity-bearing execution environments, not just software repositories.
A question worth separating out:
Q: Which controls matter most when malware spreads through trusted build tooling?
A: Prioritise isolated build runners, short-lived credentials, artifact signing, and policy enforcement on dependency installation and publishing. That combination limits both secret theft and propagation when a package or workflow is compromised. Teams should also ensure that pipeline secrets cannot be reused across environments without explicit approval and review.
👉 Read our full editorial: Software supply chain attacks are becoming AI-driven and harder to contain
