HYDERABAD: Cyberattacks using malicious software packages have increased 75-fold over the past two years, with nearly half now masquerading as trusted software, according to a report by software supply chain security firm Sonatype. The study warns that attackers are increasingly targeting developers and AI-assisted software development before code reaches production.
The findings, based on 9,747 verified malicious package advisories between January 2020 and May this year, were presented by Sonatype India Country Head Abhishek Chauhan and Forrester analyst Ashutosh Sharma on Tuesday.
The report found that 47% of malicious packages impersonate legitimate software, while 53% of attacks recorded in 2025 targeted developers during software installation, enabling attackers to steal credentials and access tokens before security reviews.
Chauhan said cybercriminals are increasingly compromising the software development process by publishing fake packages resembling genuine projects and libraries. Sharma warned that organisations adopting agentic AI must guard against risks such as goal hijacking, memory corruption, excessive privileges and deceptive behaviour.
He added that global cybercrime losses reached USD 2.4 billion in 2021, while the average cost of a data breach rose to USD 2.7 million in 2024. Software supply chain breaches typically result in losses of USD 2 million to USD 3.6 million, he said.
