TeamCity Flaw and CI/CD Supply-Chain Attacks Surge in 2025

What happened

JetBrains has patched a critical vulnerability in TeamCity, the widely used continuous integration and continuous delivery server, tracked as CVE-2026-63077 1. The flaw reportedly allows unauthenticated attackers to execute commands on affected servers, a severity level that puts any exposed TeamCity instance at risk of full compromise 1. Coverage of the patch outlines the affected versions, the available upgrade paths, and mitigation steps organizations should take while they roll out fixes 1.

The disclosure lands amid a broader wave of attacks targeting the software supply chain that CI/CD systems sit at the center of. Researchers describe a campaign against an SAP-linked npm package that went after developer credentials and cloud secrets, exploiting trusted publishing mechanisms and the configuration of AI coding assistants 3. Separately, a campaign dubbed Megalodon is reported to have pushed 5,718 malicious commits across 5,561 GitHub repositories in roughly six hours, using tainted CI/CD workflows to expose secrets and cloud credentials at industrial scale 4. Another technique documented by researchers involved GitHub Action tags being redirected to point at impostor commits, a method that compromised at least 15 second-order action tags and put CI/CD credentials at risk wherever those actions were pulled into build pipelines 5.

A further campaign, described as "Mini Shai-Hulud," involved compromise of the mistralai PyPI package, where malicious code reportedly executed automatically on import, according to Microsoft 6. Related npm compromises affecting TanStack and Mistral SDK packages have been linked to the same campaign, with researchers warning the malware could expose GitHub tokens, cloud credentials, and other CI/CD secrets across both the npm and AI developer tooling ecosystems 6.

Against this backdrop, industry commentary on CI/CD practice in financial technology argues that the gap between resilient and vulnerable engineering organizations comes down to discipline: reproducible builds, gated promotion between environments, and immutable artifacts that cannot be silently altered as code moves toward production 2.

Where the reporting agrees

Across the technical incident reports, there is consistent agreement that CI/CD infrastructure has become a primary target rather than a peripheral one. The SAP npm campaign 3, the Megalodon GitHub attack 4, the GitHub Action tag hijacking 5, and the Mini Shai-Hulud campaign 6 all describe attackers going after the same category of asset: secrets, tokens, and credentials embedded in build and deployment pipelines. Each of these reports also frames the attack surface the same way — trusted, automated infrastructure that developers rely on without close scrutiny, whether that is a package registry, a GitHub Action reference, or an AI coding tool's configuration. The TeamCity disclosure fits into this same pattern by identifying another link in the CI/CD chain, the build server itself, as a point of catastrophic exposure if left unpatched 1.

Where it doesn't

The individual campaigns diverge in mechanism and scale in ways that matter. Megalodon is reported with precise figures — 5,718 commits across 5,561 repositories in about six hours — giving it a scale and velocity that none of the other campaigns claim 4. The GitHub Action tag redirection attack is described with a much smaller, specific count of 15 compromised second-order tags, suggesting a narrower but potentially more insidious technique since it exploits trust in version tags rather than brute-force volume 5. The SAP npm and Mini Shai-Hulud reports do not offer comparable numeric scope, instead emphasizing the mechanism of compromise — trusted publishing abuse and automatic execution on package import, respectively 36. Attribution and confirmation levels also differ: Microsoft is cited directly as the source confirming the mistralai PyPI compromise 6, while the SAP npm campaign's findings are presented as researcher analysis without a single named confirming authority 3. The TeamCity vulnerability stands apart from the others in that it is a patched software flaw disclosed and fixed by the vendor itself, rather than an active exploitation campcampaign uncovered by third-party researchers 1.

Reading the pattern

Taken together, the evidence does not point to one dominant attack but to a sustained, multi-front assault on CI/CD tooling spanning build servers, package registries, and GitHub-native automation. The sheer diversity of vectors — a server-side remote command execution flaw, poisoned npm packages, hijacked Action tags, and malware riding along in AI-adjacent SDKs — supports treating this as a systemic weakness in how modern software supply chains are assembled rather than a series of isolated incidents. The FinTech-focused commentary on reproducible builds and gated promotions reads less like a tangential business story and more like the practical antidote implied by every other report: the organizations least exposed to these campaigns are the ones whose pipelines already assume compromise is possible and design in verification at every stage 2.