Google Cloud Threat Intelligence: Supply Chain Compromise Campaigns and Mitigation Guidance (2025-2026)

Key facts

Detection coverage

As of 2026-09-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2657 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: npm Postinstall Script Spawning Supply-Chain Dropper (SILKBELL/axios/plain-crypto-js)

Detects a Node/npm process invoking a postinstall lifecycle hook that references setup.js or the phantom plain-crypto-js dependency, consistent with the MIDNIGHT NEPTUNE/UNC1069 axios 1.14.1/0.30.4 npm supply-chain compromise that deployed the SILKBELL dropper and WAVESHAPER.V2 backdoor. Also flags exact-hash matches against the known SILKBELL/plain-crypto-js package artifacts.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.001, T1195.002, T1059.007
• Data sources: sysmon (EventCode 1), windows_security, npm registry audit logs
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent_l=lower(ParentImage), cmd_l=lower(CommandLine)
| where like(parent_l,"%\\node.exe") OR like(parent_l,"%npm-cli.js%") OR like(cmd_l,"%npm install%") OR like(cmd_l,"%npm ci%")
| where like(cmd_l,"%postinstall%") OR like(cmd_l,"%setup.js%") OR like(cmd_l,"%plain-crypto-js%")
| eval iocHashMatch=if(match(Hashes,"(?i)58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668|e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09"),"true","false")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands by ComputerName, User, ParentImage, Image, iocHashMatch
| where count>0
| sort -last_seen

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node.exe","npm.cmd","npm-cli.js") or InitiatingProcessCommandLine has_any ("npm install","npm ci")
| where ProcessCommandLine has_any ("postinstall","setup.js","plain-crypto-js")
| extend IOCHashMatch = SHA256 in ("58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668","e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256, IOCHashMatch
| order by Timestamp desc

Sigma

title: NPM Postinstall Script Spawning Supply-Chain Dropper (SILKBELL/axios)
id: 7a2e9c14-4b1d-4f7a-9c3e-1d8a6f2b5c31
status: experimental
description: Detects a node/npm process running a postinstall lifecycle script referencing setup.js or plain-crypto-js, matching the UNC1069/MIDNIGHT NEPTUNE axios supply-chain compromise (SILKBELL dropper -> WAVESHAPER.V2).
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package
author: Threadlinqs Team
date: 2026-09-26
tags:
  - attack.initial-access
  - attack.t1195.001
  - attack.t1195.002
  - attack.execution
  - attack.t1059.007
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm-cli.js'
  selection_cmd:
    CommandLine|contains:
      - 'postinstall'
      - 'setup.js'
      - 'plain-crypto-js'
  condition: selection_parent and selection_cmd
falsepositives:
  - Legitimate npm packages compiling native modules via postinstall scripts
level: high

Known false positives:

• Legitimate npm packages that use postinstall scripts to compile native modules or download prebuilt binaries

Tuning notes: Maintain an allowlist of vetted packages with known-legitimate postinstall scripts (e.g. node-sass, sharp) to suppress routine noise; extend the hash IOC list as new plain-crypto-js/SILKBELL variants are published; on macOS/Linux fleets mirror this logic against auditd/osquery process events for /tmp/ld.py and postinstall hooks.

• 🔒 CI Runner Reading Cloud/Kubernetes/SSH Secrets Before Suspicious Egress (SANDCLOCK via pull_request_target Abuse) · unlock with TL Creds
• 🔒 Trojanized DAEMON Tools Component Spawning Unexpected Child Process (SLICKDEMON/BADFALL) · unlock with TL Creds
• 🔒 QUIC RAT Process Injection into notepad.exe/conhost.exe with Multi-Protocol C2 Egress · unlock with TL Creds
• 🔒 Notepad++ WinGUP (GUP.exe) Spawning Unsigned [indicator] Outside Install Path · unlock with TL Creds
• 🔒 CI Process Reading Cloud/Kubernetes/SSH Credential Files (SANDCLOCK Credential Access) · unlock with TL Creds
• 🔒 Network Beacon to Consolidated Supply-Chain C2 Infrastructure (Chrysalis/Cobalt Strike/WAVESHAPER.V2/QUIC RAT) · unlock with TL Creds
• 🔒 PowerShell Masquerading as Windows Terminal in ProgramData (WAVESHAPER.V2 Persistence) · unlock with TL Creds
• 🔒 WAVESHAPER.V2 Beacon to [indicator] with Spoofed IE8/Trident User-Agent · unlock with TL Creds

Indicators of compromise

As of 2026-09-26, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-2657.

Sample indicators (3 of 29)

• IP address: 142.11.206[.]73
• Domain: sfrclak[.]com
• File hash: 58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

Community OSINT corroboration

5 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

This report is a mitigation-guidance rollup published by Google Cloud/GTIG on 2026-07-30 that ties together five distinct, independently-tracked supply-chain intrusions to argue that open-source and software-update supply chains are now a primary initial-access vector for both financially-motivated and espionage-driven intrusion sets.

MIDNIGHT NEPTUNE (formerly UNC1069, DPRK-nexus and financially motivated) compromised the axios npm maintainer account via social engineering and published malicious axios versions 1.14.1 and 0.30.4 during a three-hour window on 2026-03-31 (00:21-03:20 UTC). The releases carried a phantom dependency, plain-crypto-js 4.2.1, whose postinstall hook ran the obfuscated SILKBELL JavaScript dropper (setup.js). SILKBELL fetched and executed platform-specific stagers -- a disguised PowerShell copy (wt.exe) on Windows, a Mach-O binary at /Library/Caches/com.apple.act.mond on macOS, and a Python backdoor at /tmp/ld.py on Linux -- all deploying the WAVESHAPER.V2 backdoor, which beacons every 60 seconds over HTTP to sfrclak[.]com:142.11.206.73:8000 using a spoofed IE8/Trident User-Agent. Because axios has 100M+ weekly downloads and tens of thousands of dependents, the compromise reached at least 15 industry verticals across 13 countries before GTIG-supported customers pulled the packages within three hours.

UNC6780 (aka TeamPCP, PCPcat, ShellForce, DeadCatx3, CanisterWorm) ran a sustained February-May 2026 campaign abusing the GitHub Actions pull_request_target trigger to obtain base-repository secrets and write access, then published the SANDCLOCK credential stealer through compromised packages on PyPI, npm, and Docker Hub (Aqua Security Trivy Action v0.69.4-v0.69.6 in March; LiteLLM and Telnyx Python SDK on PyPI; Bitwarden CLI npm @2026.4.0 and a re-compromised Checkmarx KICS Docker Hub image in April; a Nx Console VS Code Marketplace extension breach against GitHub's own infrastructure in May exfiltrating roughly 3,800 repositories). SANDCLOCK disguises its exfiltration as legitimate telemetry POST traffic to monitoring-service-styled domains, scraping CI runner memory for AWS keys, GitHub tokens, Kubernetes configs, and SSH private keys for direct sale or ransomware-affiliate handoff.

UNC6863 trojanized official DAEMON Tools Lite Windows installers (versions 12.5.0.2421-12.5.0.2434, signed with valid AVB Disc Soft certificates) starting 2026-04-08, tampering with DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. An initial implant beacons to env-check.daemontools[.]cc (registered 2026-03-27) and, on a small, deliberately filtered subset of the thousands of infected hosts, drops SLICKDEMON for reconnaissance/target-filtering, the shellcoded loader BADFALL for hands-on-keyboard access, and the highly obfuscated, WolfSSL-linked QUIC RAT (which injects into notepad.exe/conhost.exe and supports HTTP, UDP, TCP, WSS, QUIC, DNS and HTTP/3 C2). Despite thousands of infection attempts across 100+ countries, only a dozen hosts received second-stage tooling, concentrated against government, scientific, and manufacturing targets in Russia, Belarus, Brazil, Turkey, and Thailand.

UNC6688 compromised the shared hosting infrastructure serving notepad-plus-plus.org's WinGUP (GUP.exe) update mechanism from June to December 2025, redirecting update traffic so WinGUP spawned a malicious AutoUpdater.exe. Direct server access was cut by a hosting-provider kernel/firmware update on 2025-09-02, but the actor retained internal-service credentials and continued manipulating update traffic until 2025-12-02, delivering the Chrysalis backdoor (custom API hashing, Microsoft Warbird protection) and, via a Lua-script-injection variant, Cobalt Strike Beacon to selected targets in South Korea and France. Independent researchers (Unit 42) separately attribute this cluster to the China-nexus actor Lotus Blossom.

UNC4899, overlapping with the DPRK clusters tracked elsewhere as Jade Sleet, PUKCHONG, Slow Pisces, and TraderTraitor (Lazarus Group), executed the 2025-02-21 ByBit theft: a compromised developer workstation at a Web3 organization was used to inject malicious JavaScript into the Safe{Wallet} multisig signing interface, tricking authorized signers into approving a transaction that redirected roughly $1.4-1.5B in cryptocurrency to actor-controlled wallets, subsequently laundered across thousands of addresses on multiple blockchains.

GTIG frames all five clusters as evidence of a systemic shift and, citing OSSF data showing a 1,444% year-over-year increase in malicious open-source packages, issues administrative (SBOM/ABOM, SDLC threat modeling), package-manager (release-age cooldowns, lifecycle-script sandboxing), identity (OIDC federation, FIDO2 SSH, PAT lifespan limits), infrastructure (ephemeral CI runners, artifact-repo mirroring, code-signing HSMs), and monitoring (SCA/OSV-Scanner, egress baselining, ATO detection for maintainer accounts) mitigation guidance.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036.001 Invalid Code Signature; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection

Discovery

T1057 Process Discovery

Execution

T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols

Initial Access

T1078 Valid Accounts; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship

Persistence

T1547.001 Registry Run Keys / Startup Folder

Credential Access

T1552.001 Credentials In Files

defense-impairment

T1553.002 Code Signing

Remediation

Patches

• Upgrade axios to 1.14.0/1.6.8 or later, or 0.30.3/0.28.1 or later; remove any node_modules/plain-crypto-js/ directory entirely
• Upgrade DAEMON Tools Lite to 12.6.0.2445 or later
• Confirm Notepad++ auto-update infrastructure has completed the vendor's post-incident hosting remediation (effective December 2025)
• Update or remove TeamPCP/UNC6780-compromised packages: Aqua Security Trivy Action, Bitwarden CLI npm package, Checkmarx KICS Docker Hub image, Nx Console VS Code extension, LiteLLM and Telnyx Python SDKs on PyPI

Immediate actions

• Block C2 indicators: sfrclak[.]com, 142.11.206.73, 23.254.167.216, env-check.daemontools[.]cc, skycloudcenter[.]com, self-dns[.]it[.]com, safe-dns[.]it[.]com, cdncheck[.]it[.]com, and the listed Notepad++ update-infrastructure IPs
• Audit lockfiles/dependency trees for plain-crypto-js 4.2.0-4.2.1 and axios 1.14.1/0.30.4; purge npm/yarn/pnpm caches on affected hosts
• Treat any host that ran a compromised installer or update (DAEMON Tools 12.5.0.2421-12.5.0.2434, Notepad++ AutoUpdater.exe) as fully compromised and rebuild from clean media
• Rotate all CI/CD and developer secrets (AWS keys, GitHub PATs, Kubernetes configs, SSH private keys) on any runner or workstation that executed a flagged package or installer
• Disable or heavily restrict the pull_request_target GitHub Actions trigger on public repositories; strip secrets access and require maintainer approval for external-collaborator PR-triggered workflows

Workarounds

• Pin dependencies to known-clean versions and enforce lockfile integrity verification in CI before every build
• Disable npm/pip lifecycle scripts by default (npm: allowScripts=false / --ignore-scripts; pip: --no-binary with script review) until new package versions are vetted
• Enforce a minimum package release-age cooldown (24 hours for npm, 14 days for PyPI) before automated tooling can pull a new version
• Route all package installs through an internal proxy or private registry mirror rather than pulling directly from public registries

Longer-term hardening

• Adopt automated SBOM and Action Bill of Materials (ABOM) generation with continuous cross-referencing against disclosed vulnerabilities and known-malicious packages
• Migrate CI/CD system identities from static, long-lived PATs to short-lived OIDC-federated tokens and scoped GitHub Apps
• Mandate FIDO2 hardware-backed SSH for git operations and disable classic Personal Access Tokens organization-wide
• Deploy EDR across developer workstations and CI runners tuned to detect npm/pip postinstall-script abuse and unexpected outbound telemetry-mimicking traffic
• Implement Google Assured Open Source Software (AOSS) or equivalent provenance-signing to raise trust levels on third-party dependencies

Affected and fixed versions

• axios (OSS maintainers) — axios (npm)
  Vulnerable versions: 1.14.1; 0.30.4
  Fixed in: 1.14.0 or 1.6.8+; 0.30.3 or 0.28.1+
• npm ecosystem (malicious package) — plain-crypto-js
  Vulnerable versions: 4.2.0; 4.2.1
• Disc Soft Ltd (AVB Disc Soft) — DAEMON Tools Lite
  Vulnerable versions: 12.5.0.2421; 12.5.0.2434; range 12.5.0.2421-12.5.0.2434
  Fixed in: 12.6.0.2445
• Notepad++ project / third-party hosting provider — Notepad++ update distribution (WinGUP / GUP.exe)
  Vulnerable versions: update hosting infrastructure, June-December 2025
  Fixed in: hosting infrastructure remediated, effective December 2025
• Safe (Safe Ecosystem Foundation) — Safe{Wallet} web frontend
  Vulnerable versions: frontend JavaScript served February 2025
  Fixed in: frontend remediated post-incident
• Multiple OSS maintainers — Aqua Security Trivy Action, Bitwarden CLI (npm), Checkmarx KICS (Docker Hub), Nx Console (VS Code Marketplace), LiteLLM (PyPI), Xinference (PyPI), Telnyx Python SDK (PyPI)
  Vulnerable versions: Trivy Action v0.69.4-v0.69.6; Bitwarden CLI @2026.4.0; various, February-May 2026
  Fixed in: patched or removed by respective maintainers post-disclosure

Timeline

• 2025-02-21 UNC4899/TraderTraitor injects malicious JavaScript into the Safe{Wallet} multisig signing interface, tricking authorized signers at ByBit into approving a transaction that results in the theft of approximately $1.4-1.5B in cryptocurrency.
• 2025-06-01 UNC6688 (separately attributed by Unit 42 to Lotus Blossom) compromises the shared hosting infrastructure serving Notepad++'s WinGUP update mechanism, beginning a six-month campaign.
• 2025-09-02 A hosting-provider kernel and firmware update severs UNC6688's direct server access to the Notepad++ update infrastructure; retained internal-service credentials allow continued manipulation.
• 2025-12-02 UNC6688's remaining access to Notepad++ internal hosting services is cut off, ending the update-infrastructure compromise.
• 2026-02-26 FBI and IC3 publish a joint PSA formally attributing the ByBit theft to North Korea (TraderTraitor) and listing approximately 50 Ethereum wallet addresses used in laundering.
• 2026-03-19 UNC6780/TeamPCP compromises the Aqua Security Trivy GitHub Action (versions 0.69.4-0.69.6), deploying the SANDCLOCK credential stealer across more than 10,000 CI/CD runs.
• 2026-03-27 The C2 domain locked-ioc-10 is registered ahead of the DAEMON Tools installer compromise.
• 2026-03-31 MIDNIGHT NEPTUNE/UNC1069 publishes malicious axios versions 1.14.1 and 0.30.4 bundling the plain-crypto-js 4.2.1 dropper, deploying WAVESHAPER.V2 to Windows, macOS, and Linux targets during a three-hour window (00:21-03:20 UTC) before removal.
• 2026-04-08 UNC6863 begins trojanizing official DAEMON Tools Lite installers (versions 12.5.0.2421-12.5.0.2434) distributed from the legitimate vendor website.
• 2026-04-21 UNC6780/TeamPCP conducts concurrent compromises of the Bitwarden CLI npm package and a re-compromised Checkmarx KICS Docker Hub image.
• 2026-05-01 The DAEMON Tools supply-chain compromise is publicly disclosed, with thousands of recorded infection attempts across 100+ countries and second-stage QUIC RAT delivery limited to roughly a dozen targeted hosts.
• 2026-05-18 UNC6780/TeamPCP breaches GitHub's internal infrastructure via a trojanized Nx Console VS Code Marketplace extension, exfiltrating approximately 3,800 repositories over an 18-minute window.
• 2026-07-30 Google Cloud Threat Intelligence Group publishes consolidated mitigation guidance covering all five campaigns, citing a 1,444% year-over-year increase in identified malicious open-source packages.

Sources cited

• Mitigation guidance for supply chain compromise Google Cloud · Advisory · 2026-07-30
• North Korea Responsible for $1.5 Billion Bybit Hack fbi.gov · Advisory · 2025-02-26
• North Korea Responsible for $1.5 Billion Bybit Hack (PSA) ic3.gov · Advisory · 2025-02-26
• North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack Google Cloud · Vendor report · 2026-04-01
• TeamPCP (UNC6780): AI Supply Chain's Most Active Threat Actor labs.cloudsecurityalliance.org · Research · 2026-05-01
• TeamPCP: the supply chain attack story so far teampcp.pluto.security · Research · 2026-05-01
• Popular DAEMON Tools software compromised Kaspersky Securelist · Research · 2026-05-01
• Nation-State Actors Exploit Notepad++ Supply Chain Unit 42 · Research · 2026-02-02
• Notepad++ Hijacked by State-Sponsored Hackers notepad-plus-plus.org · Vendor report · 2026-02-01
• Axios npm Supply Chain Attack FAQ: North Korea UNC1069 Tenable · Blog · 2026-04-01
• What We Learned: Axios NPM Supply Chain Compromise Emergency Briefing sans.org · Blog · 2026-04-02
• TeamPCP Supply Chain Campaign: Update 008 - 26-Day Pause Ends with Three Concurrent Compromises isc.sans.edu · Blog · 2026-04-27
• Notepad++ Supply Chain Compromise FAQ Tenable · Blog · 2026-02-02
• DAEMON Tools Supply Chain Attack Compromises Official Installers with Malware The Hacker News · News · 2026-05-01

Related threats

• Malicious open-source packages: axios npm account hijack (plain-crypto-js / WAVESHAPER.V2), tensorflow-opt PyPI miner, and Contagious Interview multi-ecosystem campaign
• Evolution of Web3 in Cloud Supply Chain Attacks: Blockchain Smart-Contract C2 (EtherHiding, TxDataHiding, NullReceiver) in DPRK-Linked npm/Go/Packagist/Rust Campaigns

More from UNC1069

• ClickFix Copy-Paste Terminal Campaigns Targeting macOS and Windows: MacSync Stealer Lures and DPRK UNC1069 Multi-Stage Intrusions (Objective-See: Stopped at ⌘+V)
• Mastra npm Packages Trojanized with Malicious easy-day-js Dependency (UNC1069)
• Hackers poison arrayref Rust crate (0.3.10) via proc-macro1 typosquat to push DPRK-linked cross-platform infostealer backdoor at compile time
• Rust Supply Chain Attack on arrayref: Malicious Crate Versions with DPRK-Linked Backdoor
• Popular Rust Crates arrayref, internment, append-only-vec Compromised in Build-Time Supply Chain Attack via proc-macro1 Typosquat (DPRK/Sapphire Sleet)
• Popular Rust Packages With 244M Downloads Compromised in Supply Chain Attack

Previous and next in supply chain

• Adform Ad-Tech Platform Compromised: Trojanized Tracking Script Serves Crypto Clipboard Stealer via Supply-Chain Attack Previous report
• Re-Enabled actions-cool GitHub Actions (issues-helper, maintain-one-comment) Resume Executing Mini Shai-Hulud CI/CD Credential-Theft Payload Next report

Further reading

• npm Supply Chain Attacks 2026: 218 Packages
• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs