Open-source software is today one of the most powerful drivers of innovation. But the recent discovery of Sonatype shows the other side of the coin: a global espionage campaign infiltrated malicious packages into repositories like npm and PyPI, exploiting structural flaws in open-source ecosystems.

Between January and July 2025, more than 230 malware packages disguised as legitimate libraries were blocked. These attacks exploit known weaknesses—transitive dependencies, poorly protected CI/CD pipelines, and a lack of visibility into the components used. Ultimately, many organizations don’t even know for sure which libraries they have in production, making them vulnerable when a flaw is discovered.

How does Sonatype respond?

Sonatype didn’t just identify the problem; it provided practical solutions that allow development teams to protect their pipelines. Key features include:

• Repository Firewall, which prevents malicious packets from entering before they reach the organization’s code;
• Lifecycle, which alerts about vulnerabilities in components already in use;
• Continuous generation and analysis of SBOMs (Software Bill of Materials), ensuring complete traceability of each facility.

With these measures, it is possible not only to block threats before they have an impact, but also to gain control over an increasingly complex and exposed ecosystem.

What does this mean for your organization?

For any company that relies on modern software, the lesson is clear: it’s not enough to trust the open-source community; continuous monitoring, validation, and protection are necessary. This involves:

• know all the dependencies used, both direct and transitive;
• implement tools that block malicious packets at the entrance;
• adopt SBOMs to ensure traceability;
• apply security early in the development cycle (shift left).

The role of homeostase

At homeostase, we track these emerging threats and help companies turn theory into practice. We work with market-leading solutions, such as those from Sonatype, to ensure that malicious dependencies don’t enter your pipeline and that your software supply chain remains sound and reliable.

Ao combinar observabilidade, segurança e automação, apoiamos equipas a reduzir riscos e a criar aplicações mais seguras, sem travar a inovação.

For reflection

The campaign unveiled by Sonatype is a warning to everyone: the software supply chain is now one of the most critical targets. Security begins with the code you choose to use—and depends on the visibility and control you implement in the process.

Talk to us and discover how homeostasis can help you protect your organization.

Source here.