Supply Chain Attacks on Crypto Ecosystem via Developer Toolchain Compromise

Supply Chain Attacks on Crypto Ecosystem via Developer (TL-2026-0248), also tracked as SANDWORM_MODE, is a high-severity supply-chain compromise, first published 2026-03-19. It is attributed to Lazarus Group (North Korea) with medium confidence, affects npm npm Registry Packages, references 3 CVEs (CVE-2025-30066, CVE-2025-69263, CVE-2025-69264), maps to 29 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 25 indicators of compromise.

Key facts for TL-2026-0248

Threat ID
TL-2026-0248
Also known as
SANDWORM_MODE, s1ngularity, GhostAction, Operation Marstech Mayhem, Shai-Hulud, PackageGate
Severity
HIGH
Status
MONITORING
Category
SUPPLY_CHAIN
First published
2026-03-19
Last reviewed
2026-03-19
Attribution
Lazarus Group
Attribution confidence
MEDIUM
Nation-state nexus
North Korea
Motivation
FINANCIAL
Target sectors
financial, cryptocurrency, technology, software-development, fintech, defi, blockchain
Target regions
Global, North America, Europe, Asia
Detection rules
9
Indicators of compromise
25

Malware and tooling in Supply Chain Attacks on Crypto Ecosystem via Developer

Malware and tooling: Marstech1, Cloudflare Workers (pkg-metrics.official334.workers.dev)

Adversaries are actively exploiting supply chain weaknesses in the cryptocurrency ecosystem through four primary vectors: dependency/IDE poisoning (npm, marketplace), Kubernetes control-plane component replacement, developer identity compromise leading to CI/CD workflow poisoning, and third-party credential abuse. Real-world incidents from Q4 2025 through Q1 2026 confirm rapid pivot from developer endpoint compromise to fraudulent cryptocurrency transfers.

How Supply Chain Attacks on Crypto Ecosystem via Developer works

A convergence of supply chain attack campaigns is targeting the cryptocurrency ecosystem through systematic compromise of developer toolchains, CI/CD infrastructure, and cloud-native runtime environments. This threat profile documents four interconnected attack vectors observed across multiple incidents investigated by Sygnia and other security firms between Q4 2025 and Q1 2026.

**Vector 1 — Ecosystem Poisoning of Dependencies and Developer Tooling:** Attackers poison npm packages and IDE marketplace extensions to achieve code execution via trusted distribution channels. The SANDWORM_MODE campaign (disclosed February 2026 by Socket Research) deployed 19 typosquatting npm packages under aliases 'official334' and 'javaorg' that harvest credentials, inject malicious MCP server configurations into AI coding assistants, establish persistence through git hooks, and exfiltrate cryptocurrency keys via multiple channels including Cloudflare Workers endpoints and DNS tunneling. The s1ngularity campaign (August 2025) compromised the popular Nx build system (4.6M weekly downloads) via maintainer account takeover, embedding crypto-wallet-stealing malware in telemetry.js that exfiltrated 2,349 credentials from 1,079 developer systems. The September 2025 npm supply chain attack compromised 18 packages including chalk and debug (2.6B weekly downloads combined) within 16 minutes of phishing a maintainer's npm account, deploying browser-based crypto-drainer malware that hooked fetch, XMLHttpRequest, window.ethereum, and Solana wallet APIs. The Lazarus Group's Operation Marstech Mayhem deployed 800+ malicious npm packages targeting Exodus, Atomic, and MetaMask wallets across Windows, macOS, and Linux. Six PackageGate zero-day vulnerabilities (disclosed January 2026) in npm, pnpm, vlt, and Bun further undermined post-Shai-Hulud defenses.

**Vector 2 — Kubernetes Control-Plane Component Replacement:** Attackers deploy malicious networking components in the kube-system namespace, replacing legitimate kube-proxy pods to intercept cluster traffic, access Kubernetes secrets, and enable fraudulent transactions. This vector targets the most privileged namespace in Kubernetes clusters where monitoring coverage is typically weakest. Observed techniques include binary replacement in kube-system, kubectl exec abuse across hundreds of pods for reconnaissance, and high-volume secret reads from Key Vault and secret stores.

**Vector 3 — Developer Identity Compromise to CI/CD Workflow Poisoning:** Compromised developer GitHub accounts are leveraged to inject malicious workflows that generate cloud service account credentials and exfiltrate secrets. The GhostAction campaign (September 2025) compromised 327 GitHub accounts to steal 3,325 secrets across 817 repositories via malicious workflows exfiltrating data to 45.139.104.115. The tj-actions/changed-files compromise (March 2025, CVE-2025-30066) impacted 23,000+ repositories through cascading dependency compromise. Observed kill chain: malicious workflow creation → service account key generation → cloud tenant enumeration → Kubernetes exec for metadata reconnaissance → vault credential theft → withdrawal execution.

**Vector 4 — Third-Party Credentials as Supply-Chain Bridges:** Vendor API keys discovered in source repositories (custody providers, communications platforms) are abused to conduct fraudulent transactions. This vector exploits the trust relationship between crypto organizations and their third-party service providers, enabling direct access to custody APIs and signing services without requiring additional exploitation.

**Kill Chain:** Developer endpoint → repository/CI compromise → automation identity abuse → cloud/Kubernetes control plane → secrets store/key vault access → custody API invocation → fraudulent cryptocurrency withdrawal.

The financial impact is severe: the Lazarus Group's February 2025 Bybit attack alone resulted in $1.5 billion in cryptocurrency theft. The operational tempo has accelerated significantly, with SANDWORM_MODE introducing 48-hour time-gated execution, DGA-based C2 infrastructure, and AI toolchain poisoning capabilities not seen in earlier campaigns.

MITRE ATT&CK techniques used in TL-2026-0248

collection

T1005 Data from Local System; T1119 Automated Collection

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1078 Valid Accounts; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails

exfiltration

T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service

execution

T1059 Command and Scripting Interpreter; T1204 User Execution; T1609 Container Administration Command

command-and-control

T1071 Application Layer Protocol; T1568 Dynamic Resolution

persistence

T1098 Account Manipulation

initial-access

T1195 Supply Chain Compromise; T1199 Trusted Relationship

credential-access

T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

privilege-escalation

T1546 Event Triggered Execution

discovery

T1580 Cloud Infrastructure Discovery; T1613 Container and Resource Discovery

resource-development

T1583 Acquire Infrastructure; T1585 Establish Accounts; T1586 Compromise Accounts

reconnaissance

T1596 Search Open Technical Databases

impact

T1657 Financial Theft

Affected products and versions in Supply Chain Attacks on Crypto Ecosystem via Developer

  • npm — npm Registry Packages
    Vulnerable versions: Multiple typosquatting packages
    Fixed in: Packages removed from registry
  • Nrwl — Nx Build System
    Vulnerable versions: 20.9.0; 20.10.0; 20.11.0; 20.12.0; 21.5.0; 21.6.0; 21.7.0; 21.8.0
    Fixed in: Post-s1ngularity patched versions
  • pnpm — pnpm
    Vulnerable versions: Pre-CVE-2025-69263 patch
    Fixed in: Patched versions
  • Oven — Bun
    Vulnerable versions: Pre-PackageGate patch
    Fixed in: Patched versions
  • Vlt — vlt
    Vulnerable versions: Pre-PackageGate patch
    Fixed in: Patched versions
  • tj-actions — changed-files
    Vulnerable versions: <=45.0.7
    Fixed in: Post-CVE-2025-30066 versions
  • GitHub — GitHub Actions
    Vulnerable versions: All (workflow injection vector)
    Fixed in: N/A — requires configuration hardening
  • Kubernetes — Kubernetes
    Vulnerable versions: All (kube-system namespace targeting)
    Fixed in: N/A — requires runtime hardening
  • Microsoft — Azure Key Vault
    Vulnerable versions: All (secret exfiltration target)
    Fixed in: N/A — requires access policy hardening

Remediation for Supply Chain Attacks on Crypto Ecosystem via Developer

Patches

  • Update pnpm to patched versions (CVE-2025-69263, CVE-2025-69264)
  • Pin tj-actions/changed-files to known-good commit hash (post CVE-2025-30066)
  • Update vlt and Bun to PackageGate-patched versions
  • Remove or update any Nx packages from compromised s1ngularity versions

Immediate actions

  • Audit all npm dependencies for known malicious packages (SANDWORM_MODE list: claud-code, cloude-code, cloude, crypto-locale, crypto-reader-info, detect-cache, format-defaults, hardhta, locale-loader-pro, naniod, node-native-bridge, opencraw, parse-compat, rimarf, scan-store, secp256, suport-color, veim, yarsg)
  • Block C2 domains at perimeter: pkg-metrics.official334.workers.dev, freefan.net, fanfree.net
  • Block exfiltration IP 45.139.104.115 and domain bold-dhawan.45-139-104-115.plesk.page
  • Rotate all npm tokens, GitHub PATs, SSH keys, AWS credentials, and API keys that may have been exposed
  • Inspect git global config for unauthorized init.templateDir modifications
  • Check ~/.git-templates/hooks/ for malicious pre-commit and pre-push hooks
  • Scan for payload staging in /dev/shm/.node_*.js files
  • Verify kube-system namespace pods match expected images and binaries

Workarounds

  • Use npm audit and socket.dev CLI to scan for known malicious packages before install
  • Disable postinstall scripts in npm via --ignore-scripts flag for untrusted packages
  • Use lockfile-lint to validate lockfile integrity before builds
  • Enable GitHub Advanced Security secret scanning on all repositories
  • Implement independent custody monitoring with out-of-band transaction verification

Longer-term hardening

  • Enforce CODEOWNERS and branch protection with required reviews for workflow file changes
  • Use ephemeral CI/CD runners with short-lived tokens instead of persistent credentials
  • Implement runtime binary verification and image signing with Sigstore/cosign for Kubernetes
  • Deploy withdrawal allowlists, velocity limits, and step-up approval for custody APIs
  • Restrict kubectl exec in kube-system namespace via admission controllers
  • Enforce dependency pinning by hash, not by version tag
  • Segment workload identities to prevent lateral movement from CI to production
  • Monitor for high-volume Key Vault SecretGet patterns and correlate with upstream code changes
  • Deploy on-chain transaction monitoring correlated with CI/CD activity

CVEs associated with Supply Chain Attacks on Crypto Ecosystem via Developer

CVE-2025-30066, CVE-2025-69263, CVE-2025-69264

Weaknesses (CWE) in Supply Chain Attacks on Crypto Ecosystem via Developer

CWE-506, CWE-829, CWE-494, CWE-522, CWE-798, CWE-319, CWE-693

Timeline of Supply Chain Attacks on Crypto Ecosystem via Developer

  • Lazarus Group Marstech1 implant first emerged targeting cryptocurrency wallets (Exodus, Atomic, MetaMask) via malicious npm packages
  • Lazarus Group executed $1.5 billion cryptocurrency theft from Bybit exchange via supply chain compromise
  • tj-actions/changed-files GitHub Action compromised (CVE-2025-30066), impacting 23,000+ repositories with CI/CD secret exfiltration
  • Operation Marstech Mayhem campaign actively targeting developers via social platforms with 230+ confirmed victims across US, Europe, and Asia
  • s1ngularity attack compromised Nx build system (4.6M weekly downloads), embedding crypto-wallet-stealing telemetry.js malware in 8 malicious versions
  • First signs of GhostAction campaign detected on compromised FastUUID project via GitHub user Grommash9
  • GitGuardian discovered GhostAction campaign: 327 compromised GitHub accounts, 3,325 secrets stolen across 817 repositories via malicious workflows
  • 18 npm packages including chalk and debug (2.6B weekly downloads) compromised via phished maintainer account, deploying browser crypto-drainer within 16 minutes
  • Six PackageGate zero-day vulnerabilities disclosed in npm, pnpm, vlt, and Bun, undermining post-Shai-Hulud supply chain defenses
  • SANDWORM_MODE threat actor GitHub profile 'official334' created, beginning infrastructure setup for npm worm campaign
  • Socket Research disclosed SANDWORM_MODE: 19 typosquatting npm packages with self-propagation, AI toolchain poisoning, DNS exfiltration, and 48-hour time-gated execution
  • Sygnia published comprehensive analysis documenting four supply chain attack vectors targeting crypto ecosystem: dependency poisoning, K8s control-plane replacement, CI/CD workflow poisoning, and third-party credential abuse
  • As of 2026-05-29, this crypto-ecosystem supply-chain threat remains active: although SANDWORM_MODE infrastructure was taken down and CVE-2025-30066 is patched and in CISA KEV, the same attack class is escalating via Mini/Shai-Hulud 2.0 waves (TeamPCP May 11/19, Lazarus-linked axios). The named sub-campaigns are contained but fresh npm worm waves and crypto/AI-toolchain theft continue, so MONITORING fits better than CONTAINED.

Sources cited for Supply Chain Attacks on Crypto Ecosystem via Developer

Threats related to Supply Chain Attacks on Crypto Ecosystem via Developer

Detection coverage for TL-2026-0248

As of 2026-03-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0248 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats