CrowdStrike Extends Its Endpoint Advantage to Secure the Software Supply Chain

As AI rewrites how software gets built, CrowdStrike stops malicious open-source packages at the endpoint before they execute

AUSTIN, Texas & LAS VEGAS, September 02, 2026--Fal.Con 2026-- CrowdStrike (NASDAQ: CRWD) today introduced Real-Time Supply Chain Attack Protection, a new Falcon platform innovation that blocks malicious open-source packages at the endpoint before their embedded code can run.

AI has changed how software gets built. Coding agents now assemble applications from open-source packages pulled off public registries at machine speed, faster than anyone can review what comes in. A poisoned package runs its code on the endpoint the moment it installs. The endpoint is the point of execution, and where the Falcon sensor already operates. CrowdStrike blocks malicious packages in real time, before that code can run.

"Attackers know that compromising one trusted package can give them a path into thousands of organizations. That makes the software supply chain one of the most powerful attack surfaces in the AI era," said Michael Sentonas, president of CrowdStrike. "The endpoint is where malicious code executes, and only CrowdStrike turns it into the control point that stops the attack."

Software Supply Chain Risk Converges on the Endpoint

Adversaries have industrialized poisoning the packages enterprises trust. CrowdStrike's 2026 Threat Hunting Report found DPRK-nexus adversary STARDUST CHOLLIMA poisoned 131 trusted AI framework packages, while eCrime actor ALTERED SPIDER compromised more than 300 software dependencies in a single day. The risk no longer stops at engineering. As AI agents spread across the business, any endpoint can pull a package to finish a task, and the attack surface widens to the whole enterprise.

A poisoned package does not look like malware. It arrives as an ordinary file and runs its code the moment it installs. Legacy endpoint tools were built to catch executables, not to govern the packages that assemble AI software. Standalone scanners, proxies, and browser-based tools flag compromises days after poisoned packages have already landed. If not stopped at the endpoint before embedded scripts execute, a poisoned package moves downstream, giving adversaries a foothold.

Stopping Malicious Packages Before They Run

CrowdStrike Real-Time Supply Chain Attack Protection stops malicious packages the moment they reach the endpoint, intercepting at the command line, before any embedded script runs. Because CrowdStrike already enforces at that checkpoint through the same sensor, adversary intelligence, and response orchestration securing the endpoint, protection carries forward into whatever the package tries to do next: execution, credential access, lateral movement. No new agent, and no coverage gaps.