Attacks Move Beyond Vulnerabilities

The number of malicious package attacks on open source registries such as npm and rubygems has increased significantly from 2021 to 2022, posing a growing security risk to the open source ecosystem. According to Mend research, there has been a 315% increase in the publication of malicious packages to these registries. These packages can cause significant damage, including stealing credentials, exfiltrating data, turning devices into botnets, or erasing data. As a result, malicious packages have become increasingly popular among threat actors who target applications.

Unfortunately, many companies have only recently started exploring technologies that can defend against these attacks. Mend's 360-degree malicious package protection has already identified evidence of threat actor success in the form of thousands of malicious packages hidden in existing code bases.