Threat reportSupply ChainTL-2026-3729
Open Source Supply Chain Attack Surge: 56 Confirmed Attacks in 12 Months Across npm, PyPI, RubyGems, Composer, Rust Crates and GitHub Actions (Shai-Hulud, TeamPCP, Axios, Miasma, ChainDrop)
Open Source Supply Chain Attack Surge (TL-2026-3729), also tracked as Shai-Hulud, is a critical-severity supply-chain compromise, first published 2026-10-16. It is attributed to TeamPCP with low confidence, affects npm ecosystem axios, maps to 22 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 0None referenced
- Techniques
- 22MITRE ATT&CK
- Actors
- 1TeamPCP
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-3729
- Threat ID
- TL-2026-3729
- Also known as
- Shai-Hulud, Sha1-Hulud, CanisterWorm, Miasma, ChainDrop, Hades
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- TeamPCP
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cloud, finance, ai-ml
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Open Source Supply Chain Attack Surge
Malware and tooling: CanisterWorm, Hades, Shai-Hulud
How Open Source Supply Chain Attack Surge works
StepSecurity reports 56 confirmed open source supply chain attacks in 12 months, rising from roughly 1 per month (Aug 2025-Jan 2026) to roughly 9 per month (Feb-Aug 2026). Named campaigns include Shai-Hulud, CanisterWorm, TeamPCP (Trivy, Checkmarx KICS, LiteLLM, telnyx), the axios npm compromise, Miasma and ChainDrop.
StepSecurity's 'State of Open Source Supply Chain Attacks' (2026-08-22) counts 56 confirmed attacks over 12 months: 6 between Aug 2025 and Jan 2026 and about 50 between Feb and Aug 2026, roughly one every three days since March 2026. npm accounts for the majority (~27-30 incidents), followed by GitHub Actions (~15), PyPI (5+), crates.io (3+), RubyGems (2+) and Composer (2+). The report names three recurring weaknesses: secrets stored in CI/CD pipelines and on developer machines, unpinned/latest dependency versions, and unrestricted outbound network access from runners and developer machines.
Shai-Hulud (Sept 2025) was a self-propagating npm worm that used stolen npm tokens to backdoor 500+ packages; a second wave ('Sha1-Hulud', Nov 2025) hit Zapier and ENS Domains packages and was later found in CNCF Backstage. Mini Shai-Hulud variants followed in April-May 2026 (SAP-related, TanStack and AntV packages). ChainDrop (4 Aug 2026, Elastic Security Labs) trojanized the keyv monorepo and spread to 2,251 versions of 452 npm packages. Its preinstall dropper (setup.mjs) downloads the Bun runtime and runs a ~710 KB obfuscated stealer that harvests 300+ credential patterns, encrypts them with AES-256-GCM under an RSA-wrapped key, and resolves its C2 from an Ethereum smart contract. It falls back to a signed GitHub commit marker, and it persists through .claude/settings.json SessionStart hooks and .vscode/tasks.json folderOpen tasks.
TeamPCP (aka PCPcat, ShellForce, DeadCatx3) ran a cascading campaign between 19 and 27 March 2026. A stolen PAT, obtained via a misconfigured pull_request_target workflow, was used to repoint 76 of 77 aquasecurity/trivy-action tags. Stolen CI/CD credentials were then reused against Checkmarx KICS/AST GitHub Actions and OpenVSX, LiteLLM on PyPI (1.82.7/1.82.8, with a .pth startup hook), and the telnyx PyPI SDK (4.87.1/4.87.2, which hides a XOR-encrypted second stage in WAV audio frames). The payloads steal cloud, SSH, Kubernetes and LLM API credentials, install a systemd user service (sysmon.service), deploy privileged 'node-setup-*' pods, and in the CanisterWorm variant use an Internet Computer (ICP) canister as C2 plus a wiper component. StepSecurity cites 78,330 secrets stolen from 2,186 organizations.
On 30-31 March 2026 a hijacked maintainer npm account published axios 1.14.1 and 0.30.4, which add the dependency plain-crypto-js@4.2.1. Its postinstall dropper contacts sfrclak.com:8000 and installs a platform-specific RAT (AppleScript binary on macOS, VBScript/PowerShell on Windows, Python on Linux), then erases its own traces. StepSecurity's AI Package Analyst flagged the release and Harden-Runner captured the C2 callback in CNCF Backstage CI. The Miasma worm (June-July 2026) pushed workflow and AI-agent configuration files using stolen developer credentials. GitHub disabled 73 Microsoft repositories, including Azure/functions-action, and a 'Hades' wave used Python .pth hooks to run a Bun-based stealer. Also reported: AI-driven exploitation of Actions workflows by 'hackerbot-claw' against Microsoft, Datadog and CNCF projects, mutable-tag poisoning of smaller Actions, SleeperGem (RubyGems), Laravel-Lang tag rewrites (Composer), and build-time dropper crates (arrayref, internment, append-only-vec). Several details are single-source from StepSecurity; IOCs below come from the primary vendor analyses cited in references.
MITRE ATT&CK techniques used in TL-2026-3729
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information
Execution
T1059.001 PowerShell; T1059.006 Python; T1059.007 JavaScript; T1610 Deploy Container
Initial Access
T1078 Valid Accounts; T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain
Command and Control
T1102.001 Dead Drop Resolver; T1571 Non-Standard Port
Impact
Persistence
T1543.002 Systemd Service; T1546.018 Python Startup Hooks
Credential Access
T1552.005 Cloud Instance Metadata API; T1552.007 Container API; T1555 Credentials from Password Stores
Resource Development
Affected products and versions in Open Source Supply Chain Attack Surge
- npm ecosystem — axios
Vulnerable versions: 1.14.1; 0.30.4
Fixed in: 1.14.0; 0.30.3 - npm ecosystem — keyv, flat-cache, cacheable-request, cacheable, cache-manager (ChainDrop)
Vulnerable versions: trojanized versions published 2026-08-04 - Aqua Security — trivy-action / setup-trivy GitHub Actions and aquasec/trivy images
Vulnerable versions: 76 of 77 trivy-action tags; setup-trivy 0.2.0-0.2.6; image 0.69.4-0.69.6 - Checkmarx — kics-github-action and ast-github-action
Vulnerable versions: kics-github-action all 35 tags; ast-github-action v2.3.28 - BerriAI — LiteLLM (PyPI)
Vulnerable versions: 1.82.7; 1.82.8 - Telnyx — telnyx Python SDK (PyPI)
Vulnerable versions: 4.87.1; 4.87.2 - Microsoft — Azure/functions-action and Azure/durabletask (Miasma)
Vulnerable versions: June 2026 repository state
Remediation for Open Source Supply Chain Attack Surge
Patches
- Downgrade axios to 1.14.0 or 0.30.3 and remove plain-crypto-js 4.2.1
- Upgrade litellm and telnyx to releases newer than the compromised versions, and use Trivy and Checkmarx Action releases republished after the incidents
Immediate actions
- Treat any host or CI runner that installed axios 1.14.1/0.30.4, litellm 1.82.7/1.82.8, telnyx 4.87.1/4.87.2 or a ChainDrop-affected package as compromised and rotate all reachable secrets (npm/PyPI/GitHub tokens, cloud keys, SSH keys, Kubernetes service account tokens, LLM API keys)
- Block egress to the C2 domains and IPs listed in the IOCs and hunt for sysmon.service, litellm_init.pth, node-setup-* pods, .claude/settings.json and .vscode/tasks.json modifications
- Audit GitHub for unexpected workflow files, 'docs-tpcp' repositories and commits authored by claude@users.noreply.github.com with message 'chore: update config'
Workarounds
- Run npm install with --ignore-scripts in CI
- Quarantine newly published package versions via an internal registry proxy before they reach runners
Longer-term hardening
- Restrict runner and developer-machine outbound traffic with an egress allowlist (e.g. Harden-Runner)
- Pin GitHub Actions to full commit SHAs and dependencies to exact versions with lockfiles and a release cool-down period
- Use npm trusted publishing and short-lived, scoped tokens; enforce 2FA with no bypass_2fa automation tokens
- Remove long-lived secrets from CI/CD and avoid pull_request_target workflows that run untrusted code
Weaknesses (CWE) in Open Source Supply Chain Attack Surge
Timeline of Open Source Supply Chain Attack Surge
- Shai-Hulud self-propagating npm worm compromises 500+ packages using stolen npm tokens (first wave, September 2025).
- Second wave (Sha1-Hulud) hits Zapier and ENS Domains packages and is later detected in CNCF Backstage by Harden-Runner (November 2025).
- TeamPCP uses a stolen PAT to force-push malicious code to 76 of 77 aquasecurity/trivy-action tags and setup-trivy.
- Checkmarx KICS/AST GitHub Actions and OpenVSX compromised with credentials stolen in the Trivy wave (Datadog dates the Checkmarx/OpenVSX compromise 23 March; Unit 42 gives 21 March).
- Malicious LiteLLM 1.82.7 and 1.82.8 published to PyPI, exfiltrating to models.litellm.cloud and checkmarx.zone.
- telnyx 4.87.1 and 4.87.2 published to PyPI with a WAV-hidden credential stealer.
- Hijacked maintainer account publishes axios 1.14.1 (00:21 UTC) and 0.30.4 (01:00 UTC) with plain-crypto-js@4.2.1 RAT dropper; removed from npm at 03:29 UTC.
- Miasma worm pushes malicious commit to Azure/durabletask; GitHub disables 73 Microsoft repositories including Azure/functions-action.
- Socket detects 37 malicious wheels across 19 PyPI packages in the Hades wave, using .pth hooks to launch a Bun-based stealer.
- Elastic identifies ChainDrop: trojanized keyv monorepo spreads to 2,251 versions of 452 npm packages, with Ethereum smart contract C2.
- StepSecurity publishes its 12-month analysis counting 56 confirmed attacks, about 9 per month since February 2026.
Sources cited for Open Source Supply Chain Attack Surge
- The State of Open Source Supply Chain Attacks (StepSecurity)
- TeamPCP Supply Chain Attacks (Palo Alto Unit 42)
- LiteLLM compromised on PyPI: TeamPCP supply chain campaign (Datadog Security Labs)
- The Telnyx SDK on PyPI Compromise and the 2026 TeamPCP Supply Chain Attacks (Akamai)
- TeamPCP: Trojanized Security Tools Backdoor AI Infrastructure (Cloud Security Alliance)
- Shai-Hulud ChainDrop npm supply chain (Elastic Security Labs)
- Tracking Shai-Hulud: Inside the ChainDrop npm worm (Zscaler)
- ChainDrop npm worm (StepSecurity)
- axios npm package compromised, supply chain attack delivers cross-platform RAT (Snyk)
- Hackers compromise axios npm package to drop cross-platform malware (BleepingComputer)
- Miasma Worm Reaches Microsoft Azure and PyPI: 73 Repositories Disabled (Phoenix Security)
Detection coverage for TL-2026-3729
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3729 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3729
2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.