# Threat numbers behind a pre-install check

Compiled 2026-11-12 (America/New_York). Every figure below has a primary source and a date. Vendor “malicious package” totals are not interchangeable and are not averaged. A longer source sheet, including figures that were considered and dropped, is kept internally.

This page is context for why a pre-install check exists. It is not a claim that KarmaDue would have prevented a stated fraction of losses, and it is not a safety guarantee.

## Malicious packages (npm and PyPI)

**ReversingLabs, 27 January 2026**, [2026 Software Supply Chain Security Report](https://www.reversinglabs.com/press-releases/reversinglabs-2026-software-supply-chain-security-report-identifies-73-increase-in-malicious-open-source-packages) ([PDF](https://3375217.fs1.hubspotusercontent-na1.net/hubfs/3375217/Software%20Supply%20Chain%20Security%20Report%202026.pdf)):

- Detections of malicious open-source packages rose 73% in 2025.
- npm detections more than doubled, from 5,290 (2024) to 10,819 (2025), and were nearly 90% of the malware RL detected.
- PyPI detections fell 43%, from 1,575 (2024) to 891 (2025).

**Sonatype, 2026 State of the Software Supply Chain** ([malware chapter](https://www.sonatype.com/state-of-the-software-supply-chain/2026/open-source-malware)):

- More than 454,600 new malicious packages in 2025, and a cumulative total of over 1.233 million across npm, PyPI, Maven Central, NuGet and Hugging Face. Over 99% of the 2025 total was on npm.
- These totals include industrial-scale registry-abuse campaigns such as IndonesianFoods (169,538 npm packages in Sonatype’s table). That is why they are much larger than ReversingLabs’ confirmed-malware counts. Use one series or the other; do not blend them.

**Sonatype quarterly indexes:** [Q1 2026](https://www.sonatype.com/press-releases/sonatype-q1-2026-open-source-malware-index) recorded 21,764 malicious packages (npm 75%, PyPI 18%). [Q3 2026](https://www.sonatype.com/blog/q3-2026-open-source-malware-index-when-compromise-compounds) recorded 149,329 that quarter, cumulative 1,960,846, with npm at 89.5% of the quarter.

## Compromised maintainers and worms

- **CISA, 23 September 2025:** the Shai-Hulud npm worm [compromised over 500 packages](https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem). It stole developer and cloud credentials and used them to publish further compromised releases. CISA advised pinning npm dependencies to known-safe releases from before 16 September 2025.
- **ReversingLabs, 27 January 2026:** across two Shai-hulud campaigns, more than 1,000 npm packages were compromised and an estimated 25,000 GitHub repositories were exposed. That is a wider window than CISA’s September “500+” figure.
- **GitHub advisory [GHSA-4x49-vf9v-38px](https://github.com/debug-js/debug/security/advisories/GHSA-4x49-vf9v-38px), 15 September 2025:** on 8 September 2025 the npm account for `debug` was taken over after a phishing attack and `debug@4.4.2` shipped browser-targeted cryptocurrency-redirect malware. This is a separate event from Shai-Hulud. Related Qix-maintained packages, including `chalk`, were part of the same takeover (see the advisory’s references).
- **Socket, 10 October 2025:** North Korea’s Contagious Interview campaign — [more than 338 malicious npm packages and over 50,000 cumulative downloads](https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages) in the wave since 14 July 2025, often delivered as a fake job-interview `npm install`.

## MCP servers and tool poisoning

- **Invariant Labs, 1 April 2025:** [tool-poisoning attacks](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks) — hidden instructions in MCP tool descriptions that the model follows and the user may not see. A [7 April 2025 demonstration](https://invariantlabs.ai/blog/whatsapp-mcp-exploited) showed an untrusted server inducing exfiltration from a trusted WhatsApp MCP server. These are documented techniques, not a victim census.
- **JFrog, 9 July 2025:** [CVE-2025-6514](https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability/) (CVSS 9.6) in `mcp-remote` 0.0.5–0.1.15, fixed in 0.1.16. A malicious remote MCP server can achieve OS command execution on the client via a crafted OAuth `authorization_endpoint`.
- **Koi / Palo Alto Networks, 25 September 2025:** [first widely reported malicious MCP server in the wild](https://www.paloaltonetworks.com/blog/security-operations/first-malicious-mcp-in-the-wild-the-postmark-backdoor-thats-stealing-your-emails/) — unofficial `postmark-mcp` v1.0.16+ BCC’d every email to an attacker address. About 1,500 weekly downloads at the time of the report. OSV: [MAL-2025-47604](https://osv.dev/vulnerability/MAL-2025-47604).
- **Endor Labs, 23 February 2026:** [SANDWORM_MODE](https://www.endorlabs.com/learn/sandworm-mode-dissecting-a-multi-stage-npm-supply-chain-attack) — typo-squatted npm packages installed a rogue MCP server into Claude Code, Cursor, Windsurf and Continue.

## Agent-caused and agent-abusing incidents

- **Nx official advisory [GHSA-cxm3-wv7p-598c](https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c), 27 August 2025:** malicious `nx` and plugin versions were on npm for about five hours on 26 August 2025. A `postinstall` script stole credentials and posted them to `s1ngularity-repository*` repos. [Snyk’s analysis](https://snyk.io/blog/weaponizing-ai-coding-agents-for-malware-in-the-nx-malicious-package/) found the payload also invoked local `claude`, `gemini` and `q` CLIs with guardrails disabled. Nx Console for VS Code installed `nx@latest` on launch, which widened the blast radius.
- **Spracklen et al., USENIX Security 2025:** [We Have a Package for You!](https://www.usenix.org/conference/usenixsecurity25/presentation/spracklen) — 16 code-generation models, 576,000 samples. Average hallucinated package rates of at least 5.2% (commercial models) and 21.7% (open-source models), and 205,474 unique invented names. This is risk research, not a count of successful attacks.
- **Cursor, 29 October 2026:** [malicious `Anthropic.claude-code` versions 2.1.312 and 2.1.313](https://cursor.com/blog/claude-code-extension-security-notice) appeared in the Cursor VS Code Extension Marketplace for about eleven hours and tried to install an SSH backdoor. They were not published by Anthropic.

## What this is not

These figures were seen in secondary write-ups and are **not** used here, because a primary source was not confirmed this compile: a single global OSV `MAL-*` census, Phylum’s “35,000 this year,” Datadog dataset row counts, Snyk year-total malware counts, and any dollar-loss or North Korea theft total.

For how KarmaDue’s own past answers hold up against OSV, see [the v0 scorecard](https://karmadue.expo.app/docs/scorecard.md).