The most consequential open-source security incidents of 2025

The most consequential open-source security incidents of 2025 did not exploit novel vulnerabilities—they exploited trust. Attackers compromised maintainer accounts and automated build pipelines to propagate malicious updates through legitimate channels, harvesting access across thousands of downstream environments with zero-day-free campaigns.