Supply Chain Attacks Now Account for 1 in 4 Major Incidents, and Trusted Software Is the Way In

Modern software relies heavily on open source packages, and developers and AI coding agents can pull in new dependencies and versions at speed. That helps teams build and ship faster, but it also creates a gap for security teams. When a trusted package is compromised, malicious code can reach development environments and build pipelines before vulnerability databases flag it.

Most organisations scan new packages against known vulnerabilities and block them if needed. However, a zero-day supply chain compromise will not appear in those databases straight away. Because popular packages are already trusted, build pipelines are often set to pull their latest versions automatically. A malicious update can therefore spread before a CVE is even published. Wiz Research says notable supply chain attacks made up about 10% of significant incidents in H2 2025, rising to 25% in H1 2026.

The Axios compromise shows the risk. An unknown threat actor compromised the npm account of an Axios maintainer and published two malicious versions (v1.14.1 and v0.30.4). These added a dependency on plain-crypto-js, a newly created malicious package. The versions were removed within hours, but Axios was present in about 80% of cloud and code environments and downloaded around 100 million times a week. Wiz observed execution in 3% of affected environments, underlining why speed matters in defence.