More, and More Extensive, Supply Chain Attacks

Security researcher jefftk has documented a concerning acceleration in software supply chain attacks, with open-source component compromises jumping from just 2 incidents in 2024 to 6 in 2025. The attacks have evolved from targeting single projects to creating cascading compromise chains—like the Trivy incident that led to LiteLLM and Telnyx breaches. This escalation coincides with AI tools becoming powerful enough to find and exploit vulnerabilities that traditional fuzzers missed for decades, fundamentally changing the attack landscape.

Linux security reports have surged from 2-3 per week two years ago to 5-10 per day currently, overwhelming maintainers. AI agents exacerbate the problem by automatically pulling unvetted dependencies, though they also offer defensive potential through automated code review and vulnerability detection. While the short-term outlook is grim with AI-assisted attacks accelerating, long-term defense may improve as automated systems catch up—potentially identifying security bugs faster than they're created for the first time in software history.