Security researchers have warned that the open source ecosystem has become a “structural risk,” after revealing another surge in malicious packages last year. Sonatype said in its 2026 State of the Software Supply Chain report that developers downloaded components 9.8 trillion times last year across Maven Central, PyPl, npm and NuGet. The challenge is that many of these contained malware or vulnerabilities. The security vendor said it discovered 454,648 new malicious packages last year, warning that threats had evolved from “spam and stunts” into “sustained, industrialized campaigns” – many of which are state sponsored. “Public registries provide a low-friction distribution channel, while developer machines and CI/CD pipelines provide an execution environment that often sits close to…