Sonatype-State-of-The-Software-Supplychain-2026.md

The Sonatype State of the Software Supply Chain report (2026) finds that open source registries are under systemic strain and that attackers treat open source as a delivery channel: Sonatype logged 1.233M malicious packages since 2019 (454,600 new in 2025), with npm accounting for most malware; vulnerability intelligence is incomplete and slow (many CVEs unscored or inaccurate), EOL components create permanent exposure, and ungrounded AI agents hallucinate versions or recommend compromised packages—together creating large-scale, structural supply chain risk that requires lifecycle governance, grounded intelligence for AI, and regulatory-grade transparency (SBOMs/attestations).