CrowdStrike has announced a new feature that blocks malicious open-source packages at the endpoint before execution. Behind this is a sharp increase in software supply chain contamination risks accompanying the widespread adoption of AI coding.

Key points of the incident regarding the pre-execution blocking of malicious open-source packages

CrowdStrike has announced “CrowdStrike Real-Time Supply Chain Attack Protection,” a new technology that automatically blocks malicious open-source software (OSS) packages from executing on endpoints in development and production environments. In recent years, autonomous coding agents utilizing generative AI have been widely adopted, and it is becoming common practice for developers to build code by automatically acquiring external OSS packages without issuing explicit instructions. However, accompanying this is the worsening threat of supply chain attacks, where maliciously tainted packages are downloaded via package managers and malicious code is executed the moment they are installed.

This feature monitors in real time transactions (such as npm install and pip install) of major package managers like npm and PyPI running on Windows, macOS, and Linux operating systems. It detects malicious scripts embedded within packages at an extremely brief moment before they are executed on the command line and blocks them. Its greatest feature is that it operates by integrating the existing Falcon sensor, threat intelligence, and Charlotte Agentic SOAR—an automation infrastructure—without requiring the deployment of additional agents. Furthermore, it is equipped with a global package inventory function that tracks software packages installed on all endpoints within the organization, as well as an automated retrospective investigation function upon detection, thereby strengthening security from the development stage.

For the overall system architecture and defense process, please refer to the image below.

The Rapid Spread of AI Coding and Rapid Changes in Supply Chain Threats

Behind this new feature announcement lies a shift in software development methodologies driven by the advancement of AI technology, alongside a rapid escalation in sophisticated attack methods that exploit this transition. While the utilization of AI coding tools has significantly accelerated development speed, delays in security validation have become a major issue. According to verification data, the security test passing rate for source code automatically generated by AI remains at only about 56%, highlighting the current reality where code vulnerabilities are easily left unaddressed.

Additionally, cases of attackers exploiting AI to launch cyberattacks surged by 89% year-over-year. The “breakout time”—the average time it takes for an attacker to move from initial intrusion to escalating privileges across the internal network—was reduced by 65% year-over-year to an average of 29 minutes, with the shortest recorded time being a mere 27 seconds. Furthermore, estimates indicate that the computational cost of sophisticated attacks using AI agents can be kept under $50, allowing threats to spread at an overwhelmingly low cost and high speed compared to traditional manual attacks.

Traditional major supply chain attacks were primarily centered around typosquatting, which uses names resembling well-known packages. However, in recent years, they have been shifting toward sophisticated tactics such as the following:

• Tampering with Legitimate Packages via OSS Maintainer Account Takeover
• GitHub Actions Tag Rewriting (Tag Poisoning)
• Malicious code execution exploiting installation scripts (postinstall/preinstall)
• Compromise of the security scanner itself and worm-like lateral movement originating from CI tokens

Cases where such trusted development pathways themselves are exploited are on the rise, creating a situation that cannot be prevented by traditional perimeter defense or mere static code analysis alone.

Defense Mechanisms in Development Environments and the Transformation of Security Operations

Instant Blocking Upon Installation and Real-Time Integration Mechanism

The malicious OSS pre-execution blocking feature comprehensively protects all endpoints, from developer workstations to server environments and endpoints running agent-based applications. When a package manager downloads and extracts files to a device, it intercepts at the command-line level before any embedded execution scripts can start running, forcefully terminating the process. This makes it possible to completely block threats before attackers can gain a foothold.

This feature allows you to set up advanced control rules, enabling you to apply fine-grained operational policies, such as “deferring installation for packages that have not met a specified minimum release age (min-release-age) since they were published.” This significantly reduces the risk of unknown malicious packages flowing into the development environment immediately after publication.

Additionally, once a malicious package is detected, the following automated integration process is immediately initiated across the entire platform:

• Conducting automated retrospective investigations targeting all endpoints within the organization
• Automated Initiation of Isolation and Remediation Actions via Charlotte Agentic SOAR
• Inventory updates that visualize the locations of affected devices and packages in real-time

Rather than reacting after an attack has occurred, orchestration functions simultaneously with the incident, minimizing the operational burden on security personnel while preventing the spread of damage.

The defense execution flow and coordination structure are as shown in the figure below.

The Limits of Conventional Instant Updates and Structural Transformation on the Defensive Side

In traditional cybersecurity policy, the golden rule has always been to “apply security patches or the latest version immediately upon the announcement of a vulnerability.” However, due to the increase in software supply chain attacks, that premise is being shaken. This is because if malicious code is mixed into official package or library updates themselves, performing immediate updates without verification risks causing damage instead.

The number of disclosed vulnerabilities is increasing explosively year by year, with 48,185 vulnerabilities reported in 2025. It is projected to reach approximately 66,000 per year in 2026. Furthermore, the time from a vulnerability’s disclosure to its exploitation in actual attacks has plummeted dramatically from an average of 21.5 days in 2025 to just 18 hours in 2026, with a median time from disclosure to exploitation of 5 days.

To cope with such accelerating attack speeds, manually evaluating vulnerability severity and deciding whether to apply a patch or wait is becoming physically impossible. Therefore, development organizations are required to undergo structural transformations in their operations, such as the following:

• Zero-trust for dependencies (managing under the assumption that even well-known packages can be compromised)
• Strict version pinning using lockfiles (such as package-lock.json, uv.lock, etc.)
• Disabling installation-time lifecycle scripts (ignore-scripts) as a general rule
• Introduction of an automated quarantine mechanism through package retention period settings

Rather than simply aiming for rapid patching, a “pre-execution prevention” mechanism—which proactively blocks code execution until safety is confirmed—has become an essential requirement in modern development infrastructure.

Tectonic Shifts in Governance and Future Outlook

Industry-Wide Seismic Shifts as Seen in Clarified Accountability and Stricter Regulations

The debate surrounding software safety and vendor responsibility is seeing rapid changes globally, not only in technical measures but also from the perspectives of legal regulations and market structures. In the European Union (EU), the Cyber Resilience Act (CRA) entered into force in December 2024. Vulnerability reporting obligations will begin in September 2026, and all provisions are scheduled to be fully applicable by December 2027. The CRA mandates that products with digital elements ensure security across their entire lifecycle, from design to maintenance and disposal, and violations are subject to substantial fines of up to 15 million euros or 2.5% of global turnover.

Furthermore, in the United States, there is a growing movement to clarify the legal liability of software vendors (software product liability) and to mandate the submission of Software Bills of Materials (SBOMs). Judicial rulings and the restructuring of legal frameworks are advancing to hold development vendors accountable for software defects and security vulnerabilities that were previously exempted under traditional license agreements.

Amid such tightening global regulations, companies are required to maintain full transparency and accountability not only for the code they develop in-house, but also for libraries and open-source components procured externally. As a means to prove the transparency of the development process, the following initiatives are becoming standardized.

• Utilizing Third-Party Audits and Certification Systems to Ensure the Safety of the Entire Supply Chain
• Automated generation and continuous management of SBOMs to visualize vendor and library dependencies
• Clarifying security standards for the use of suppliers and open source

Security measures are not merely a technical cost, but a critical management issue for avoiding corporate legal risks and ensuring business continuity in the global market.

Future Developments and Key Points to Watch in Autonomous AI Security

Efforts by security vendors such as CrowdStrike point to a new defense model for the AI era. Looking ahead, we can expect a full-scale transition to an era of “autonomous security,” in which both attackers and defenders make full use of AI agents to counter one another. Methods that improve detection accuracy by internally pitting an offensive model (Red Tempest) against a defensive model (Blue Solano)—such as CrowdStrike’s SafeMind—along with automated response powered by advanced context analysis, are already being put into practical use.

Going forward, the key points that development organizations and security leaders should focus on are as follows:

• Establishing Access Control and Governance Frameworks for AI Coding Agents
• Integrated protection for development environments (IDEs, CI/CD pipelines, and package managers)
• Building a Development Process for Automated Quarantine Without Compromising Development Speed
• Continuous vulnerability management and SBOM support for compliance with the European CRA and various national regulations

While AI is dramatically accelerating software manufacturing speeds, verifying its security through human effort alone is impossible. The technology of “pre-execution blocking,” which automatically eliminates risks at the exact moment code is written and packages are loaded, will become established as an indispensable guardrail in future software development infrastructure.

Reference Page

• [CrowdStrike Press Releases] https://www.crowdstrike.com/ja-jp/press-releases/
• [Technical Details on the Outage on July 19, 2024 | CrowdStrike] https://www.crowdstrike.jp/technical-details-on-todays-outage/
• 【Realigning Incentives to Build Better Software: a Holistic Approach to Vendor Accountability – arXiv】https://arxiv.org/abs/2501.12345

【#CrowdStrike #Cybersecurity #OpenSource #AICoding #SupplyChainAttack】