Rise of Malicious npm Packages Threatens Developer Trust

• •1.8 million malicious packages logged, with npm comprising 96.6% of the total.
• •ReversingLabs identified a malicious npm package targeting Twilio developers to exfiltrate data.
• •npm plans to implement pre-publish scanning to combat the rising threat of malicious packages.

As of Q2 2026, Sonatype Research logged 1.8 million malicious packages, with npm accounting for 96.6% of this total. The quarter saw a surge in repository abuse, trojan-class malware, and maintainer compromises, indicating a shift towards targeting trusted developer workflows. ReversingLabs reported a specific malicious npm campaign that compromised packages related to Twilio, aiming to exfiltrate sensitive data. The number of malicious npm packages has risen sharply, with 5723 unique packages identified by August 2026, surpassing the total for all of 2024. Despite npm's efforts to implement pre-publish scanning to mitigate these threats, the volume of malicious packages continues to grow. Attackers are employing social engineering tactics and exploiting trusted packages, with notable campaigns like Shai-Hulud leading to widespread infections. The overall threat landscape remains concerning, with a significant concentration of malicious activity across various ecosystems, particularly npm, PyPI, and NuGet.