CrowdStrike Extends Endpoint Security to Stop Software Supply Chain Attacks

Real-Time Supply Chain Attack Protection, embedded into the Falcon sensor, blocks malicious open-source packages at download to secure the endpoint as the primary enforcement point where AI operates.

Software supply chain attacks pose a critical enterprise threat. In the first half of 2026, these attacks increasingly used malicious software packages uploaded to public software registries, the CrowdStrike 2026 Threat Hunting Report found.

Adversaries are poisoning open-source packages and exploiting the same dependencies that AI-assisted development tools and agentic applications pull onto enterprise endpoints every day. The endpoint is where those malicious packages land, execute, and need to be stopped.

CrowdStrike is advancing endpoint security with Real-Time Supply Chain Attack Protection, a capability natively embedded in the lightweight CrowdStrike Falcon® sensor. It detects and blocks malicious open-source packages as they reach the endpoint, before any embedded code can execute, and provides a global inventory of installed packages across the organization. It requires no new sensor deployment, separate tool, or changes to developer workflows.

The Problem Extends Beyond Developer Workstations

When most organizations think about software supply chain risk, they think about developers running npm install or pip install on their workstations. That is a critical surface, but the picture has gotten much larger.

In the AI era, everyone is a developer. Agentic applications like Claude Code and ChatGPT Codex are now used across marketing, HR, finance, and operations teams. These tools automate tasks, generate content, and build internal workflows. When an agentic application recommends downloading a package to complete a task, employees across the business may unknowingly expose their endpoints to compromised dependencies. The attack surface has expanded from a few hundred developer machines to potentially every company endpoint.