Nearly 2 million malicious open source packages to-date. In Q3 2026, nearly 3 in 4 malicious packages exhibiting overt malware behavior involved droppers, secrets exfiltration, or both. One bad package can become a much bigger compromise.
sonatype.com/blog/q3-2026-o…
