Open Source Supply Chain Attacks Surge as Worms Hit npm and PyPI

A year of poisoned packages

In 2026, attacks on the open source software supply chain stopped being occasional events and became routine. StepSecurity counted 56 confirmed incidents in the 12 months to August. Until February 2026 it saw roughly one a month. After that the rate jumped to 13 in March and stayed near nine a month, which works out to about one attack every three days1. Phoenix Security uses a different method and reached a similar result: it logged 52 campaigns in 2026 up to July 15, compared with 6 in all of 20246. The two firms count differently, so their totals don't match exactly. Both still show a sharp rise starting in early 2026.

The targets were core tools that most developers use without much thought. Victims included the Trivy vulnerability scanner, Checkmarx's KICS, the LiteLLM AI proxy, the Telnyx SDK, Axios, TanStack, Alibaba's AntV libraries, node-ipc, Red Hat's cloud-services npm packages, Microsoft's durabletask SDK and the keyv caching family711152416. The attackers mostly did not exploit bugs in code. They exploited the trust that open source distribution depends on: maintainer accounts, release pipelines and package registries.

March: a security scanner becomes the entry point

The year's defining campaign started with a vulnerability scanner. A group known as TeamPCP, which Google tracks as UNC6780, abused a misconfigured pull_request_target workflow in Trivy's GitHub repository and stole a bot credential in late February2829. Reports describe Aqua Security's credential rotation afterward as incomplete. The attackers kept enough access to hijack 75 release tags and push malicious Docker images8.

After that, each compromise supplied credentials for the next one. TeamPCP used CI/CD secrets taken from Trivy users to poison Checkmarx's KICS GitHub Action. It then published backdoored LiteLLM and Telnyx releases to PyPI, because both projects ran Trivy in their build pipelines10. Snyk reports that LiteLLM installed Trivy without pinning a version, and the compromised action took the project's PyPI publishing token straight from the runner environment28. The malicious LiteLLM release dropped a .pth file, which runs every time Python starts, even if nothing imports the package21.

The accounts disagree on a few dates. The Register says malware was injected into Trivy on March 16 and KICS was hit on March 2310. DreamFactory's timeline lists March 19 and March 218. These differences matter less than the pattern all the reports describe: one compromise opening the way to the next, across several ecosystems, within about a week25. Red Hat later said none of its products had shipped with compromised versions. It still felt the need to publish a formal bulletin on the March wave7.

Axios and the state-actor question

On March 31, a separate attacker took over the lead maintainer's npm account for Axios, an HTTP client with about 100 million weekly downloads. They published two versions that pulled in a remote-access trojan through a typosquatted dependency, plain-crypto-js1217. The bad releases were online for about three hours17. Huntress still saw at least 135 endpoints contact the attackers' infrastructure during that time12. CISA put out an alert on the incident in April20.

Reports agree on how the attack worked but describe the attacker with varying confidence. DreamFactory listed the attacker as unknown and a suspected APT8. The Register called the group North Korean-linked10. Other reports link it to BlueNoroff or to UNC1069, citing Google412. The later reports consistently point to Pyongyang, and the earlier caution looks like a gap in information at the time rather than a real disagreement. Another detail matters for defenders: the attack reportedly went around npm's OIDC trusted publishing completely8. That control was supposed to make this kind of account abuse harder.

The worm era

The bigger change was self-propagation. The Shai-Hulud worm first appeared on npm in September 2025, and ReversingLabs says it compromised more than 1,000 packages over two campaigns5. In 2026 its successors spread quickly: CanisterWorm in March, "Mini Shai-Hulud" waves against SAP, TanStack and AntV packages in April and May, Miasma in June and July, and ChainDrop in August1.

The TanStack wave on May 11 shows how fast this moves. Unit 42 counted 84 malicious artifacts across 42 packages within six minutes, and 373 malicious versions across 169 packages by the end of the day11. In the wave that followed, attackers took over a single maintainer account and published hundreds of versions. SafeDep counted 630 versions across 317 packages in about 20 minutes3. Unit 42 counted 639 across 323 in about an hour11. TechCrunch reported that two OpenAI employees' machines were compromised through the TanStack incident3.

The most important event of the year may have been on May 12, when the full Mini Shai-Hulud toolchain was posted publicly on GitHub, including its CI cache-poisoning scripts and OIDC token extractor11. Aikido says TeamPCP published the code alongside forum posts encouraging others to run their own campaigns19. Three weeks later, 32 @redhat-cloud-services packages were hit with Miasma, a close variant19. Unit 42 openly asked whether the AsyncAPI compromise in July was more Miasma activity or a copycat11. In practice, once the code was public, it stopped mattering much who was behind each attack, because anyone could run the same playbook.

The techniques also became more capable. StepSecurity found that the Red Hat payload used npm's bypass_2fa parameter to republish packages even from accounts protected by two-factor authentication18. ChainDrop hit keyv and related packages, some with more than 150 million weekly downloads. It ran under the Bun runtime rather than Node and used an Ethereum smart contract to find its command server131. Snyk found that the malicious keyv release carried genuine SLSA provenance16. That means the signals meant to verify a package's origin had been turned against the people relying on them.

Why the open source model is exposed

The reports point to a structural problem. Open source depends on a small number of volunteer or lightly resourced maintainers whose credentials can publish to millions of machines. node-ipc shows the risk. Its compromised versions appeared about 21 months after the last legitimate release, which is consistent with attackers deliberately targeting dormant packages that still get a lot of downloads15. Analysts describe maintainer fatigue, token theft and session hijacking as standard entry points9.

CI/CD automation magnifies this. DreamFactory's analysis argues that the TeamPCP and Axios attacks shared one weakness despite their differences: credentials stored on machines that run code fetched from public registries8. This is the most convincing explanation in the coverage. Build runners load secrets into memory and then run third-party code during installation, so one poisoned package can expose everything the runner can reach. The results show how much this matters. CloudSEK published a victim dataset, which StepSecurity analyzed, showing that TeamPCP's five-day March campaign collected 78,330 secrets from 2,186 organizations, including 92 public companies1.

The usual vulnerability-management process also misses these attacks. Phoenix Security says no CVEs were assigned during active exploitation in any of the 106 campaigns it tracks. Scanners that rely on CVE feeds therefore could not see them6. These attacks don't involve a flaw that can be patched. They abuse trust that is built into how packages are distributed.

AI tooling as the next frontier

AI tooling was both a target and a delivery route. LiteLLM is an AI gateway, and Mistral and OpenAI staff were hit in the TanStack wave63. Phoenix reports that 56 of its 106 campaigns involved AI, LLM or agent tooling6. Attackers placed hidden instructions in .cursorrules and CLAUDE.md files to get coding assistants to leak secrets. They also used Claude Code session hooks to stay on a machine after the malicious package was removed6. These developer tools act on behalf of the user, and attackers are now using that same capability.

Defenses are arriving, slowly

The ecosystem is responding, but defenses are behind. PyPI began rejecting new uploads to releases older than 14 days in July 2026, which stops stolen tokens from being used to tamper with older, pinned versions29. Security vendors recommend pinning GitHub Actions to commit SHAs, filtering network egress from runners, and turning off install scripts in CI2212. Cycode notes that SHA pinning protects against moved tags but not against releases that were poisoned when they were published21.

Attacks did not slow down after the summer. StepSecurity reported a compromise of SubQuery packages on October 5. Just days later it described a Tensorlake package carrying a worm that wipes the machine if its stolen token is revoked1518. On the current evidence, 2026 marks open source supply chain attacks becoming a permanent, industrial-scale threat. Protection will depend less on verifying where a package came from and more on limiting what any installed package is able to access.