ANALYSIS
Software Supply Chain Attacks: 2025 Year in Review and 2026 Forecast
224 supply chain incidents tracked in 2025. Attack vectors, dwell times, detection rates, and the emerging AI toolchain poisoning trend.
The assumption that supply chain attacks are rare, nation-state-only events is dead. In 2025, SentinelPRO IA's threat intelligence team tracked 224 confirmed software supply chain incidents across 43 countries and 18 industry sectors. Attacks ranged from sophisticated state-sponsored implants to opportunistic package registry poisoning by low-skill actors using commodity malware-as-a-service toolkits.
2025 By the Numbers
224
Confirmed incidents
68%
Via open-source package registries
47 days
Average dwell time before detection
$2.8M
Average incident cost
The AI Toolchain Poisoning Trend
The most significant new vector in 2025: targeted poisoning of Python packages used exclusively by AI/ML engineering teams. Unlike broad npm attacks, these packages targeted data science workflows — torch-* naming conventions, Hugging Face model utilities, LangChain integration packages.
Attack pattern: publish a malicious package with a plausible typosquatted name, accumulate installs, then trigger a malicious update that exfiltrates model weights, training data, and API keys from environment variables. In 14 of the 224 cases, the primary target was the AI model infrastructure downstream — poisoned training pipelines, backdoored model weights.
Attack pattern: publish a malicious package with a plausible typosquatted name, accumulate installs, then trigger a malicious update that exfiltrates model weights, training data, and API keys from environment variables. In 14 of the 224 cases, the primary target was the AI model infrastructure downstream — poisoned training pipelines, backdoored model weights.
Top 5 Attack Vectors by Frequency
- Package registry poisoning (npm, PyPI, RubyGems) — 152 incidents (68%)
- Compromised build pipeline credentials (GitHub Actions, CircleCI) — 31 incidents (14%)
- Malicious CI/CD plugin or GitHub Action — 19 incidents (8%)
- Upstream vendor code implant (XZ Utils-style) — 12 incidents (5%)
- Dependency confusion attack — 10 incidents (5%)
2026 Threat Forecast
AI-targeted poisoning: Expect 3–5x growth in attacks targeting ML/AI toolchains. The economic incentive (model IP theft, training data exfiltration) is now well understood by threat actors.
Container registry as the new vector: Docker Hub and GHCR are the next frontier. We observed 8 incidents involving malicious base images in H2 2025.
Build-time vs. runtime split: Sophisticated actors increasingly separate implant delivery (build-time) from C2 activation (runtime), making pre-deployment scanning insufficient as a sole control.
Container registry as the new vector: Docker Hub and GHCR are the next frontier. We observed 8 incidents involving malicious base images in H2 2025.
Build-time vs. runtime split: Sophisticated actors increasingly separate implant delivery (build-time) from C2 activation (runtime), making pre-deployment scanning insufficient as a sole control.
Detection Recommendations
1. SBOM generation and monitoring: Generate a Software Bill of Materials for every build and diff it against the previous build. Unexpected new dependencies are a strong signal.
2. Package provenance verification: Use Sigstore/cosign to verify package signatures. Most major registries now support provenance attestations.
3. Runtime behavior baselining: A poisoned package eventually has to exfiltrate data or establish C2. Behavioral monitoring of your build pipeline workers catches implants that pass static analysis.
2. Package provenance verification: Use Sigstore/cosign to verify package signatures. Most major registries now support provenance attestations.
3. Runtime behavior baselining: A poisoned package eventually has to exfiltrate data or establish C2. Behavioral monitoring of your build pipeline workers catches implants that pass static analysis.
// SENTINELPRO IA IN ACTION
SentinelPRO IA's Attack Surface Monitor includes CI/CD pipeline monitoring, SBOM-based dependency analysis, and real-time package registry poisoning detection.
See Plans & Pricing →Request Demo