Ossprey Raises $2.65M as Open Source Malware Attacks Explode

Ossprey has raised $2.65 million (£2 million) in an oversubscribed pre-seed round built on a narrow wager: that most security tools still cannot tell a malicious open-source package from a normal one. The London startup scans code before it reaches production, hunting for malware hidden inside the libraries that modern software depends on.

The money arrives after ten months in which self-replicating worms hit Bitwarden, Red Hat and the AsyncAPI project, and after research firm Sonatype logged more than a million blocked malicious packages across the open-source ecosystem. Ossprey is stepping into a threat that has already scaled past what most existing tooling was built to catch.

Episode 1 Backs a Two-Founder Pre-Seed

The round was led by Episode 1 Ventures, with participation from Osney Capital and Octopus Ventures. It closed oversubscribed, meaning demand from investors outstripped the amount Ossprey set out to raise.

Ossprey was founded by Nate Dunning, its chief executive, and David Read, its chief technology officer. Dunning previously built incident response and security operations teams and, per the company’s own account, spearheaded data security work at Starling Bank, a UK digital bank. Read has spent more than 15 years in cybersecurity, including protecting AI systems used in finance. The company is a graduate of Cyber Runway, an accelerator run by the UK’s Department for Science, Innovation and Technology (DSIT, the government ministry overseeing tech policy).

The platform continuously scans open-source packages for malware, letting development teams secure their software without slowing engineering workflows. Cash from the round will go toward product development, hiring across engineering and sales, and expansion into the United States and continental Europe.

“We founded Ossprey because existing approaches weren’t designed for the pace modern engineering teams now operate at,” said Dunning. “Organisations shouldn’t have to choose between shipping software quickly and building it securely.”

The Open Source Habit Nobody Priced Correctly

Around 90 per cent of enterprise software now runs on open-source components, according to Ossprey. Sonatype’s own research puts the figure at 80 to 90 per cent of modern applications, a close enough match to suggest the number is not exaggerated.

What changed is the volume moving through that pipeline. AI coding assistants let teams generate and ship code faster than review processes were ever designed to handle, and every extra dependency is another door an attacker can walk through disguised as legitimate software.

Sonatype’s 2026 State of the Software Supply Chain report puts a number on the resulting mess. The security vendor logged more than 454,600 new malicious packages in 2025 alone, pushing its cumulative total of blocked malware past 1.233 million, a 75 per cent jump from the year before.

• 9.8 trillion component downloads across Maven Central, PyPI, npm and NuGet in the past year, per Sonatype
• 454,648 new malicious open-source packages identified in 2025
• 1.233 million cumulative malicious packages Sonatype has now catalogued and blocked
• 75 per cent year-over-year growth in that cumulative count

Brian Fox, Sonatype’s co-founder and chief technology officer, framed the shift bluntly in the report’s release.

The commons is production infrastructure now, attackers know it, and AI puts the whole system on fast-forward.

Fox added that the open-source trade-off itself has not changed. What changed, in his words, is the scale and the stakes riding on it.

Ten Months, Six Compromises

The drumbeat of incidents behind that data is not abstract. Since last autumn, a lineage of attacks tied to the self-replicating Shai-Hulud worm, named for the giant sandworms in the novel Dune, has hit some of the most widely used names in open source.

1. September 2025 – The first Shai-Hulud wave compromises roughly 180 npm packages using stolen developer credentials, an incident researchers later called the end of the “nuisance era” of npm attacks.
2. Late March 2026 – Attackers hijack a maintainer account for axios, a JavaScript library with more than 100 million weekly downloads, and publish versions carrying a cross-platform remote access trojan disguised as a phantom dependency.
3. April 22, 2026 – A version of the Bitwarden CLI package is briefly poisoned on npm, embedding the string “Shai-Hulud: The Third Coming” and exfiltrating developer credentials to public GitHub repositories.
4. May 12, 2026 – A campaign dubbed Mini Shai-Hulud compromises TanStack, Mistral AI, UiPath and more than 160 other npm and PyPI packages.
5. June 1, 2026 – At least 32 packages published under Red Hat’s cloud-services npm namespace are compromised with a payload named Miasma, bypassing code review entirely.
6. July 14, 2026 – Attackers compromise release pipelines across the AsyncAPI project, republishing five trojanized package versions within about ninety minutes.

Each incident followed a similar mechanic: poison a trusted dependency rather than break into a target directly, then let normal install processes do the spreading. The Bitwarden episode alone forced developers worldwide to rotate cloud and CI/CD credentials within hours of disclosure, per the CISA advisory issued after the axios compromise the same month.

Palo Alto Networks’ Unit 42 threat research team has tracked the pattern closely. Its researchers say the Red Hat namespace attack saw the intruder bypass code review to push a payload named Miasma, one of several campaigns Unit 42 has linked to a broader escalation since the original Shai-Hulud wave.

The Gap Between a Static Scan and a Live Worm

Most existing tooling splits into two camps. One checks code before it runs, comparing it against databases of known vulnerabilities. The other watches software once it is already live in production.

Ossprey says it sits in the space between those two camps, using static analysis alongside behavioral techniques to judge how a package actually behaves rather than just whether it matches a known threat signature.

“Open-source software supply chain attacks have quietly exploded in scale and sophistication, yet security tools today can’t tell malicious code from benign,” said Millan Suri, principal at Episode 1 Ventures. “Ossprey’s detection engine catches what signature-based tools miss.”

Read has described the philosophy behind that approach as deliberately different from vendors that try to lock down open-source usage outright. “We don’t want to make security another friction point,” he said. “We want engineers to use open source freely, without having to worry about security risks.”

Did Ossprey’s Own Platform Catch the Worm?

Yes, according to the company. Ossprey says its scanning tool flagged the April Bitwarden CLI compromise as it unfolded, treating it as an early proof point for a detection engine that is barely out of pre-seed.

Kiran Payne, a software engineer at Ossprey, wrote on LinkedIn that the platform had detected a “sophisticated supply-chain attack targeting npm users via the legitimate @bitwarden/cli package,” identifying it as a multi-stage, self-propagating worm carrying the Third Coming branding. That description lines up with independent research from OX Security, which first surfaced the “Shai-Hulud: The Third Coming” string and traced the intrusion to a compromised CI/CD workflow rather than leaked credentials.

Security researcher Adnan Khan, who analyzed the incident separately, noted it marked new territory for npm’s own defenses, saying it was likely the first time a package using npm’s Trusted Publishing safeguard had been compromised at all. That detail matters for Ossprey’s pitch: even npm’s newer security layer did not stop the attack, which is exactly the blind spot the startup says it was built to close.

A Pre-Seed Check Against a Million-Package Backlog

Investors clearly like the team. Kirsten Connell, an investor with Octopus Ventures’ First Cheque Fund, called Ossprey’s focus one of the most pressing challenges in modern cybersecurity and said the founders’ technical expertise and market opportunity made the deal an easy yes.

“We’re looking forward to supporting Ossprey as it enters its next phase of growth and brings its technology to organisations around the world,” Connell said.

The mismatch is one of scale. Sonatype alone has already catalogued 1.233 million malicious packages using a research operation built over eleven years. Ossprey is starting with $2.65 million, two founders and a handful of enterprise customers, against an attack volume that grew 75 per cent in a single year and shows no sign of slowing.

That gap is exactly why the round closed oversubscribed rather than why it should worry backers. Enterprise security budgets are shifting fast toward anything that promises to catch what static scanners miss, and Ossprey’s plan is to prove the technology with UK and European customers before chasing the larger North American market it says it is built for.

Dunning has framed the mission as a straightforward trade-off that should not have to exist. AI, he said, is enabling organisations to build software faster than ever while also dramatically increasing the amount of code entering production and creating new openings for attackers to hide malicious software inside trusted packages.

Ossprey says it plans to keep expanding across the UK, Europe and North America, focusing on enterprise engineering teams building at scale, while it prepares for a larger funding round to support its next stage of growth.

Frequently Asked Questions

What is a software supply chain attack, in plain terms?

It is an attack that poisons a trusted piece of software, like an open-source package, rather than breaking into a target directly. One recent example flagged by Microsoft involved packages published under fake corporate namespaces that impersonated Sberbank’s payment tools to trick developers inside financial firms into installing them.

Why is the Shai-Hulud worm named that?

Shai-Hulud is the name of the giant sandworm deity in the novel Dune. Researchers who analyzed the malware found its authors leaned into the theme themselves, creating exfiltration repositories on GitHub with names like atreides, fremen, sandworm and sardaukar.

Did npm’s own security defenses fail during the Bitwarden attack?

Not entirely, but they were tested in a new way. Bitwarden’s CLI package publishes through npm’s Trusted Publishing system, a newer safeguard meant to remove the need for long-lived tokens, and researchers say the April compromise was likely the first known case of that specific protection being bypassed.

What is “vibe coding” and why does it worry security teams?

It is the practice of leaning heavily on AI assistants to generate working code with minimal manual review, a habit UK outlets have tied directly to Ossprey’s founding. Security researchers say it multiplies the number of dependencies pulled into a codebase, which multiplies the number of places an attacker can hide.