Sonatype detected 149,329 malicious open source packages during the third quarter of 2026, bringing its cumulative count since 2017 close to 2 million.

The company's malware index found 4,150 packages tagged as hijacked during the quarter. Eighty-eight percent were designed to steal secrets, deliver secondary payloads or do both. In the Mini Shai-Hulud campaign, Sonatype tracked 2,225 affected component versions as stolen credentials helped one compromise seed the next.

Researchers also found two non-malicious packages created to interfere with Claude-based tools reading their code. The examples point to an emerging class of package content intended to influence AI systems rather than only human developers or software runtimes.

Package counts are vendor telemetry, not a complete census of every ecosystem. Even so, the propagation pattern is important. Organizations should quarantine new dependencies, protect publishing credentials, require multifactor authentication, monitor maintainer changes and scan build output for unexpected network or secret-access behavior.