Kaspersky detected a 37% rise in malicious open-source packages in 2025, as attacks on trusted projects such as Axios and Notepad++ expose growing software supply-chain risks.
Kaspersky detected 19,484 malicious packages targeting open-source software in 2025, up from 14,197 in 2024, marking a 37% increase. The rise highlights how attackers are increasingly exploiting trusted open-source packages, maintainers and software distribution channels to reach users.
A major example was the Axios supply-chain attack in March 2026, when attackers compromised the npm account of a lead maintainer and published malicious versions of the JavaScript HTTP client library, which has more than 100 million weekly downloads. Kaspersky GReAT identified technical overlaps between the attack and the GhostCall and GhostHire campaigns linked to BlueNoroff, a financially motivated subgroup of the Lazarus Group.
Kaspersky also highlighted a Notepad++ supply-chain attack, in which a malicious installer delivered a Trojan backdoor that could maintain access to affected systems for months. An attack targeting Daemon Tools had also affected more than 2,000 victims across over 100 countries and territories since April 2026.
The company has launched an Open-Source Software Threats Data Feed covering vulnerabilities, malicious and compromised packages, riskware and hacking tools.
Supply-chain risks extend beyond open-source projects: nearly one in three organisations globally experienced a supply-chain-related incident over the past year, while 40% of Chinese businesses reported such risks.
In India, attackers also compromised the update infrastructure of Mumbai-based cybersecurity company eScan to distribute malware through its trusted update mechanism.
Kaspersky blocked 75 million attacks across APAC in H1 2026, while GReAT monitors more than 900 APT groups globally. India is among the five APAC countries most targeted by APTs. Kaspersky also said threat actors are using AI to automate reconnaissance, accelerate malware development and scale attacks.
“APAC as a global leader in digital transformation and even in AI agent adoption, coupled with its complex geopolitical environment, makes it a high-value target for threat actors behind the most advanced persistent threats.”— Sergey Lozhkin, Head of APAC and META research units at Kaspersky GReAT
