# Open-source package vulnerabilities: why dependencies are a business risk

An **open source dependency vulnerability** is now a board-level risk. On 23 December 2025 the npm package lotusbail was removed from the repositories after compromising 56,000 installations. The package posed as a legitimate WhatsApp Web library, contained working code and hid four layers of obfuscation and 27 anti-debugging traps to evade security analysis. This is not an isolated case: it is the evolution of a threat reshaping the risk perimeter of modern companies.

Open-source package vulnerabilities now account for 35% of global supply-chain attacks, with estimated losses of 60 billion dollars in 2025 according to CleanStart analysis. In Italy, where about 70% of business software embeds open-source components, fewer than half of companies systematically monitor their software dependencies. Manufacturing companies in the Po Valley, already hit by ransomware in 70% of recorded cases in the fourth quarter of 2024, now face a less visible but equally dangerous risk: the silent compromise of the software development chain.

The question is not whether to use open source — by now a structural component of any technology stack — but how to consciously manage the risks of transitive dependencies.

## Anatomy of an attack: the lotusbail npm case

Lotusbail presented itself as a fork of an established WhatsApp Web API library. Unlike rudimentary malware, it contained working code that performed the declared functions, which let it pass superficial code review and standard functional tests, accumulating 56,000 downloads in a few weeks.

The analysis by Koi.ai researchers revealed a layered defence: custom RSA encryption for data exfiltration, four progressive layers of JavaScript obfuscation, 27 anti-debugging traps distributed through the code to detect sandbox analysis environments, and a hardcoded pairing code that established a persistent backdoor surviving package removal.

The payload targeted critical business communication assets: WhatsApp Business authentication tokens, complete messages including attachments, full contact lists with organisational metadata, shared media files and API credentials in environment variables. For many Italian companies using WhatsApp Business as a primary B2B channel, integrating lotusbail exposed years of commercial correspondence. The average dwell time before detection was estimated at 10 days, during which exfiltration proceeded undisturbed.

## Why vulnerabilities in open-source packages proliferate

When a developer installs a single package, they rarely get only that component. Ecosystems like npm, PyPI or Maven Central rely on branching dependency trees: package A requires B and C, which in turn depend on D, E and F. A seemingly simple installation can introduce dozens of transitive dependencies that are not immediately visible. According to the Linux Foundation's Census II, between 70% and 90% of a modern software application consists of open-source components, most of them invisible to the development team.

Public repositories operate on a philosophy of total openness: anyone can register and publish packages with no prior code verification. The average time between the publication of a malicious package and its removal ranges from three to seven days. In September 2025 the Shai-Hulud attack compromised 18 npm packages with more than 2.6 billion combined weekly downloads, detected only after three days during which the malware spread through thousands of CI/CD pipelines.

Modern supply-chain attacks follow the logic of compromise one, infect thousands. Instead of attacking individual deployments, threat actors target the maintainer accounts of popular packages. Through a targeted phishing campaign, the attackers behind Shai-Hulud compromised the account of maintainer qix, gaining access to 18 widely used packages. Publishing compromised versions of trusted packages distributes the malware automatically through normal update flows. The problem is worsened by the concentration of responsibility: many critical packages are maintained by individual volunteers. The libxml2 library temporarily lost its only volunteer maintainer to burnout in 2025, creating critical risk for the whole ecosystem.

In Italy, the skills gap is structural. The National Cybersecurity Agency finds that only 2% of public administrations are currently compliant with national cyber perimeter requirements, and Europe faces an estimated deficit of 400,000 qualified cybersecurity professionals. For Italian companies this means difficulty finding DevSecOps figures able to manage security across the whole software development cycle.

## The company paradox: cheap open source, invisibly expensive

Market data show that Italian SMEs tend to see digital security investments as a cost to compress rather than a strategic capability to build. Adopting free open-source libraries seems to remove licence costs but introduces hidden technical debt: maintenance, security updates, periodic audits and vulnerability remediation. When a custom software contract does not explicitly include dependency audit and security review, these aspects are systematically neglected.

The prevailing logic — we are small, nobody will attack us — ignores that modern supply-chain attacks are automated and indiscriminate. Lotusbail selected no target: it hit anyone who installed the package. Software development in small and medium Italian companies often relies on junior figures, freelancers or external agencies with variable skills. Code review, when present, focuses on functionality and performance, rarely including systematic security analysis.

Automated tools such as Dependabot, npm audit, Snyk and OWASP Dependency Check produce output that requires qualified interpretation. A typical scan produces hundreds of alerts, most of them false positives or low-priority vulnerabilities. Without DevSecOps skills, teams tend to ignore alerts entirely because of the noise, losing the relevant signals. The internal security champion role is practically absent below 100 employees, leaving total dependence on external vendors for incident response.

Pressure to reduce time-to-market favours practices that increase exposure: installing packages without preliminary checks, loose versioning in package.json that allows automatic updates, and the absence of blocking security gates in CI/CD pipelines. Lock files that pin exact dependency versions are often excluded from version control or ignored during deployment, defeating the only native mechanism for reproducibility and for preventing untested dependencies from entering.

## Concrete mitigation strategies

The analysis of 2025 supply-chain attacks reveals a recurring pattern: 80% of compromises had a detection window shorter than seven days. Dependency cooldown means waiting 7-14 days before adopting new dependency versions, configured through tools such as Dependabot or Renovate with an automatic delay on proposed updates. The operational cost is nil, the implementation effort minimal and the estimated effectiveness 85%.

A Software Bill of Materials (SBOM) is a complete, structured inventory of all software components in an application, including transitive dependencies, exact versions and relationships. The NIS2 directive, transposed in Italy through legislative decree 138/2024, will require dependency traceability for operators of essential and important services, a category that includes a growing number of SMEs in the critical infrastructure supply chain. The prevailing standards are CycloneDX and SPDX, both supported by open-source tools. Beyond compliance, an SBOM enables rapid response to a zero-day vulnerability: when a flaw is found in a specific library, it immediately identifies which applications are affected.

Installing dependencies directly from public repositories during production builds introduces structural risk: it assumes that the package available today is identical to the one tested in development. Using a private registry — Artifactory, Nexus, Azure Artifacts, GitHub Packages — interposes a control layer between public repositories and the production environment. Packages are downloaded once, verified and served from the internal registry for all later builds. For particularly critical dependencies, a full fork strategy offers maximum control at the cost of significant management overhead.

Automated static analysis identifies known vulnerability patterns but systematically fails with obfuscated code. Professional code review requires specific security engineering skills, not only programming ability: understanding attack vectors, recognising suspicious patterns such as undocumented network calls or anomalous filesystem access, and analysing the complete dependency tree. For companies without an internal security team, the sensible investment is periodic external support: quarterly audits of critical dependencies, pre-release code review of features that integrate new libraries, and security awareness training for the development team.

Finally, runtime monitoring detects anomalous behaviour regardless of versioning. Tools such as Falco, Sysdig or AppArmor on Linux allow behavioural policies: a logging package should not open network connections to external IPs, a CSV parsing library should not read environment variables with credentials. Violations generate real-time alerts. This requires medium-high systems competence and is appropriate for critical production environments.

## The real cost of doing nothing

The average cost of a data breach for European SMEs ranges between 150,000 and 300,000 euros, adding GDPR sanctions, operational downtime during remediation, lost revenue, legal costs and emergency consultancy. Post-compromise downtime lasts five to twelve days on average. Customer loss after a breach is quantified at around 23% on average in retail according to Ponemon Institute analysis.

SMEs inside large corporate supply chains face growing pressure on security standards. B2B contracts increasingly include cyber-risk clauses requiring certifications such as ISO 27001 or SOC 2, specific insurance cover and periodic third-party audits. The inability to meet these requirements leads to removal from qualified supplier lists. Cyber insurance premiums rise by 40% for companies without a documented security programme.

Obsolete software dependencies accumulate known vulnerabilities over time. According to the Open Source Security and Risk Analysis Report, 89% of analysed codebases contain open-source components not updated in over four years. Every year of delay in updates exponentially increases remediation complexity. The full refactoring of an application with years of technical debt typically costs 10-15 times distributed preventive maintenance, because obsolete dependencies create cascading incompatibilities.

## Conclusion

Open-source package vulnerabilities are a strategic business risk that goes beyond the purely technical dimension. The lotusbail case and the series of documented 2025 supply-chain attacks show that modern compromises are sophisticated, scalable and hard to detect with superficial or reactive approaches.

Italian companies need a cultural transition from security as a cost to security as a necessary operational capability. This requires modest but targeted investments in concrete practices: dependency cooldown, systematic SBOM generation, private registries for critical environments, qualified code review at least on core dependencies, and DevSecOps skills available at least on a consultancy basis. The time window between adopting a compromised dependency and detecting it has shrunk to days. The moment to build defence capability is now.

The same logic reaches the AI stack, where [enterprise AI security](/en/ecorner/2025/enterprise-ai-security.html) depends on components the company does not write itself.

The same exposure lives in the most common publishing stack, where [the security of WordPress plugins](/en/ecorner/2026/wordpress-plugin-security.html) concentrates the incidents.

## Frequently asked questions

**What is an open-source dependency vulnerability?**
It is a weakness introduced through a software component that an application uses indirectly. Since most modern software is built on open-source components, compromising one package deep in the dependency tree can affect thousands of applications downstream.

**What was the lotusbail attack?**
A malicious npm package that compromised 56,000 installations, posing as a WhatsApp Web library. It contained working code, four layers of obfuscation and 27 anti-debugging traps, and it exfiltrated authentication tokens, messages, contacts and API credentials.

**What is dependency cooldown?**
A practice that delays the adoption of new dependency versions by 7-14 days, using tools such as Dependabot or Renovate. Since most malicious packages are detected within a week, the delay prevents compromised versions from reaching production.

**What is an SBOM and why does it matter?**
A Software Bill of Materials is a structured inventory of all software components in an application, including transitive dependencies. It provides visibility over what runs in production, supports NIS2 compliance and enables rapid response to zero-day vulnerabilities.

**Why are Italian SMEs particularly exposed?**
Fewer than half systematically monitor their dependencies, security is often treated as a cost to compress, and qualified DevSecOps skills are scarce. Supply-chain attacks are automated and indiscriminate, so company size offers no protection.

## Sources

CleanStart — analysis of global supply-chain attacks and losses in 2025 — https://cleanstart.com
Koi.ai — technical analysis of the lotusbail npm package — https://koi.ai
Linux Foundation, Census II — open-source components in modern applications — https://www.linuxfoundation.org
Open Source Security and Risk Analysis Report — outdated components in analysed codebases — https://www.synopsys.com/software-integrity/resources/analyst-reports/open-source-security-risk-analysis.html
Agenzia per la Cybersicurezza Nazionale — national cyber perimeter and NIS2 in Italy — https://www.acn.gov.it
Ponemon Institute — cost of a data breach and customer loss after an incident — https://www.ibm.com/reports/data-breach