Package registries got materially harder to abuse in 2026, and the volume of malicious artifacts kept climbing. Every control added removed the cheapest path to execution, and the campaigns took the next one, which was sometimes a different registry and is increasingly the same registry reached by a different technique. Technique changes cost defenders more, because they invalidate the detection built around the path that was closed.
From September 11, 2026, the EU Cyber Resilience Act requires manufacturers of products with digital elements to report actively exploited vulnerabilities, with an early warning inside 24 hours, a fuller notification inside 72, and a final report within 14 days of a corrective measure. Answering that in 24 hours means knowing where a compromised component came from and what else arrived with it.
Venue displacement
PyPI and NuGet both pushed mandatory two-factor authentication and trusted publishing, which replaces long-lived API tokens with short-lived OpenID Connect credentials issued to a CI job. Observed malware on those registries fell by roughly 43% and 60% respectively.
Over the same period npm malware more than doubled, and npm now accounts for close to 90% of open source malware observed across registries. npm has been closing the same gaps, with staged publishing shipping on May 22, 2026 to put a second-factor checkpoint between a publish command and the moment a version becomes installable, and npm v12 blocking install scripts by default.
These numbers, taken together, describe a single population of adversaries choosing the cheapest remaining route. Friction at one registry is a local win and an ecosystem-level redistribution, because nothing about the hardening reduced the number of people running these campaigns or the value of what they steal.
Relocation is only the cheaper of the two available answers, and it stops being cheap once every large registry has the same controls. The other answer is to stay put and change the technique.
Technique displacement
Lifecycle scripts had been the standard route from download to code execution for years, so tooling, guidance, and eventually npm itself moved against them, with --ignore-scripts the long-standing advice and npm v12 making blocked scripts the default.
On June 3, 2026 a self-propagating worm reached 57 packages across several hundred malicious versions without using a lifecycle script at all. It shipped a weaponized binding.gyp, the manifest that tells npm a package contains native code. npm treats the presence of that file as a signal to run node-gyp rebuild automatically, so the execution was triggered by the build system rather than by any hook a defender had been told to watch. The same worm carried an equivalent trick into RubyGems through extconf.rb.
The control was correct, and the campaign responded by finding a different way to be executed on the registry it was already using. --ignore-scripts does block that implicit rebuild, contrary to how this circulated at the time. The technique’s value lay in evading the detection and guidance that had grown up around lifecycle hooks.
Persistence followed the same pattern: when install-time execution became the thing everyone watched, the campaigns that mattered moved to session hooks and editor task configuration, which run when a developer next opens the project rather than when a package is installed. That defeats install-time monitoring and it defeats removal, since taking the package back out leaves the hook behind.
The artifacts that arrived without a governance model
Package registries spent fifteen years building defenses against namespace squatting, account takeover, and provenance fraud, while agent artifact marketplaces that started from zero around 2024 have had roughly eighteen months.
The registries hosting MCP servers and agent skills largely function as discovery catalogs. They index what exists so an agent can find it, without enforcing access control, tracking what a server does after installation, or verifying that the published artifact matches any reviewable source. Around 15% of servers listed in MCP registries ship no source code at all, which means the ordinary defense of reading before running is unavailable by default. In February 2026 a single agent marketplace was found hosting over a thousand malicious skills.
The payload here is frequently natural language rather than code. Repository configuration files that agents read as instructions, such as agent rules files checked into a project, are a delivery path no code scanner is built to inspect, because there is no code in them to find. Instructions that an agent obeys execute with the agent’s full privileges, but no code scanner will flag them because there is no code to scan.
Cross-registry visibility
npm v12 scripts policy, Dependabot cooldown, and SHA pinning each apply to a single registry, and so is the visibility they produce. Each registry can tell you what happened within its own boundaries, and none of them sees the same publisher operating under a different name on a different platform. The relevant unit is the operation: the set of artifacts that belong together because one source shipped them, spread across whichever registries were cheapest at the time. Nobody who runs one registry is positioned to see that, and the artifacts most likely to carry the next campaign are the ones sitting in catalogs with the least governance.
State-sponsored activity has followed the same logic, with public tracking recording more than 290 supply chain intrusions attributable to state-linked activity between early 2025 and mid-2026, including compromises of widely depended-upon npm packages. These groups choose the supply chain because one publishing account converts into access at every downstream consumer, and because the ecosystem’s defenses are organized per registry while their operations are not.
Cyber Resilience Act reporting, September 2026
The Cyber Resilience Act obligations arriving in September 2026 apply to manufacturers placing products with digital elements on the EU market, including products shipped years ago. The act also requires a maintained, machine-readable software bill of materials.
The SBOM tells you what is in the product. It does not tell you whether the account that published one of those components also published four others you are shipping. Teams that can answer only the first question will file an accurate 24-hour early warning about an isolated component, and will file again when the next artifact from the same source surfaces.
What the next pressure release looks like
Attested publishing is on track to become ordinary for major package registries. Trusted publishing, staged releases, and default-blocked install scripts remove most of the cheap paths that defined 2024 and 2025. A change of venue gets less attractive as the large registries converge on the same controls, which leaves the same-venue answer, so expect more of what the June worm did: execution primitives found inside systems already considered handled, and payload formats chosen because the tooling reads something else.
The second response is the more expensive one to absorb. Venue changes leave the campaign recognizable by existing detection, while technique changes invalidate it.
The governance response will reach the agent surface too, because it always does. Signing, provenance attestation, and registry review are already being proposed for MCP servers. Hardening plainly works, and the interval between hardening one surface and attacks arriving on the next keeps shrinking, so a defense organized around individual artifacts on individual platforms will always be describing the previous move.
Where Aephix fits
Tracking the source across surfaces is the problem Aephix Threat Research works on. Aephix Vantage gives you a free cross-ecosystem check before you install, and Weekly Sleuth links the week’s confirmed artifacts to the operations behind them, so a 24-hour CRA reporting window starts from what is already on file rather than from a blank page. The registries will keep getting harder to abuse, and the operations will keep moving.