Phoenix Security’s Malware Package Intelligence corpus documents 59 supply chain campaigns and 657 malicious package IOCs across npm, PyPI, VS Code, and AI agent tooling from June 2024 through June 2026. The first half of 2026 alone produced 4.5 times the package volume of all 2025 — driven by self-propagating worms, AI assistant config poisoning, and a compiled Rust implant with an eBPF rootkit. Every single campaign: zero CVEs assigned during active exploitation.