Every time a new malware campaign breaks, the same fire drill starts: a package with millions of downloads gets hijacked, advisories start flying, and every team is suddenly asking the same question: are we impacted?
Last year it was Nx, one of npm's most popular build systems. The install script harvested SSH keys, tokens, and crypto wallets, and even prompted the AI assistants already sitting on developer workstations to help hunt for secrets. Shortly after, the Shai-Hulud worm backdoored a PyPI package downloaded eight million times a month and compromised 160+ TanStack package versions, hiding in Claude Code hooks so the agent reinstalls the malware every time it runs.
Nine months later, attackers found another door into the code factory. In May, GitHub confirmed that roughly 3,800 of its internal repositories were breached after a single employee installed a poisoned VS Code extension. AI coding agents are gaining access to more pieces of the code factory, and each piece is a new attack vector.
Today we're extending our malware protection capabilities to defend more of the code factory. We're launching Threat Center, a real-time view of malicious packages as they land on public registries, with clear indication of whether your projects pull them in, and extending Package Firewall to VS Code extensions, blocking malicious extensions before they ever reach a developer's IDE.
Introducing the Threat Center
Threat Center gives you a real-time view of new malware across ecosystems like npm and PyPI and checks every entry against your projects, so you know whether you're impacted.
- Impact mapping shows which of your projects touch an affected package.
- Details that give you insight into what the malware does.
- Alerts when new malware lands, regardless of whether you are impacted.
- Research context enriches the automated analysis: our security team supplements the findings with deeper write-ups, blog links, and updates as the story develops.
Introducing support for detecting malware in VS Code extensions
Package Firewall already blocks malicious packages across several ecosystems such as npm, PyPI, Go, and Maven. Now it does the same for VS Code extensions.
Every new extension or update is scanned against the policy engine. If it's disallowed, it doesn't show up in the marketplace inside the editor. This is a real risk: it's how the GitHub breach happened. The extension involved, Nx Console, came from a verified publisher with millions of installs, until one poisoned update turned it into a credential stealer that ran the moment a developer opened a workspace.
It's built for how enterprises actually deploy. Deploy Package Firewall once through the MDM you already run, and every developer workstation is covered. No continuously running agent, wrapper, certificate or disruptions to developers.
Get started now
Threat Center shows you what malware is in the wild and whether your projects are affected. SCA determines whether it is already in your code or could be pulled in through an unpinned dependency on the next install. Package Firewall then blocks malware before it reaches a developer workstation or build. Together, they provide end-to-end protection against open source malware by identifying emerging threats, finding exposure in your applications, and preventing malicious packages from entering your environments
Threat Center and Package Firewall for VS Code Extensions will start rolling out to customers today. To see the latest campaigns mapped against your own projects, book a demo.
What's next?
When you're ready to take the next step in securing your software supply chain, here are 3 ways Endor Labs can help:
