# Open Source Supply Chain Attack Surge: 56 Confirmed Attacks in 12 Months Across npm, PyPI, RubyGems, Composer, Rust Crates and GitHub Actions (Shai-Hulud, TeamPCP, Axios, Miasma, ChainDrop)

> StepSecurity reports 56 confirmed open source supply chain attacks in 12 months, rising from roughly 1 per month (Aug 2025-Jan 2026) to roughly 9 per month (Feb-Aug 2026). Named campaigns include Shai-Hulud, CanisterWorm, TeamPCP (Trivy, Checkmarx KICS, LiteLLM, telnyx), the axios npm compromise, Miasma and ChainDrop.

- **Published:** 2026-10-16T11:05:23Z
- **Last reviewed:** 2026-10-16T11:05:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3729
- **ID:** TL-2026-3729
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

StepSecurity's 'State of Open Source Supply Chain Attacks' (2026-08-22) counts 56 confirmed attacks over 12 months: 6 between Aug 2025 and Jan 2026 and about 50 between Feb and Aug 2026, roughly one every three days since March 2026. npm accounts for the majority (~27-30 incidents), followed by GitHub Actions (~15), PyPI (5+), crates.io (3+), RubyGems (2+) and Composer (2+). The report names three recurring weaknesses: secrets stored in CI/CD pipelines and on developer machines, unpinned/latest dependency versions, and unrestricted outbound network access from runners and developer machines.

Shai-Hulud (Sept 2025) was a self-propagating npm worm that used stolen npm tokens to backdoor 500+ packages; a second wave ('Sha1-Hulud', Nov 2025) hit Zapier and ENS Domains packages and was later found in CNCF Backstage. Mini Shai-Hulud variants followed in April-May 2026 (SAP-related, TanStack and AntV packages). ChainDrop (4 Aug 2026, Elastic Security Labs) trojanized the keyv monorepo and spread to 2,251 versions of 452 npm packages. Its preinstall dropper (setup.mjs) downloads the Bun runtime and runs a ~710 KB obfuscated stealer that harvests 300+ credential patterns, encrypts them with AES-256-GCM under an RSA-wrapped key, and resolves its C2 from an Ethereum smart contract. It falls back to a signed GitHub commit marker, and it persists through .claude/settings.json SessionStart hooks and .vscode/tasks.json folderOpen tasks.

TeamPCP (aka PCPcat, ShellForce, DeadCatx3) ran a cascading campaign between 19 and 27 March 2026. A stolen PAT, obtained via a misconfigured pull_request_target workflow, was used to repoint 76 of 77 aquasecurity/trivy-action tags. Stolen CI/CD credentials were then reused against Checkmarx KICS/AST GitHub Actions and OpenVSX, LiteLLM on PyPI (1.82.7/1.82.8, with a .pth startup hook), and the telnyx PyPI SDK (4.87.1/4.87.2, which hides a XOR-encrypted second stage in WAV audio frames). The payloads steal cloud, SSH, Kubernetes and LLM API credentials, install a systemd user service (sysmon.service), deploy privileged 'node-setup-*' pods, and in the CanisterWorm variant use an Internet Computer (ICP) canister as C2 plus a wiper component. StepSecurity cites 78,330 secrets stolen from 2,186 organizations.

On 30-31 March 2026 a hijacked maintainer npm account published axios 1.14.1 and 0.30.4, which add the dependency plain-crypto-js@4.2.1. Its postinstall dropper contacts sfrclak.com:8000 and installs a platform-specific RAT (AppleScript binary on macOS, VBScript/PowerShell on Windows, Python on Linux), then erases its own traces. StepSecurity's AI Package Analyst flagged the release and Harden-Runner captured the C2 callback in CNCF Backstage CI. The Miasma worm (June-July 2026) pushed workflow and AI-agent configuration files using stolen developer credentials. GitHub disabled 73 Microsoft repositories, including Azure/functions-action, and a 'Hades' wave used Python .pth hooks to run a Bun-based stealer. Also reported: AI-driven exploitation of Actions workflows by 'hackerbot-claw' against Microsoft, Datadog and CNCF projects, mutable-tag poisoning of smaller Actions, SleeperGem (RubyGems), Laravel-Lang tag rewrites (Composer), and build-time dropper crates (arrayref, internment, append-only-vec). Several details are single-source from StepSecurity; IOCs below come from the primary vendor analyses cited in references.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1078 Valid Accounts
- T1059.001 PowerShell
- T1059.006 Python
- T1059.007 JavaScript
- T1610 Deploy Container
- T1546.018 Python Startup Hooks
- T1543.002 Systemd Service
- T1552.005 Cloud Instance Metadata API
- T1552.007 Container API
- T1555 Credentials from Password Stores
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1070.004 File Deletion
- T1005 Data from Local System
- T1571 Non-Standard Port
- T1102.001 Dead Drop Resolver
- T1485 Data Destruction
- T1583.001 Domains

## Sources

- [The State of Open Source Supply Chain Attacks (StepSecurity)](https://www.stepsecurity.io/blog/state-of-open-source-supply-chain-attacks)
- [TeamPCP Supply Chain Attacks (Palo Alto Unit 42)](https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/)
- [LiteLLM compromised on PyPI: TeamPCP supply chain campaign (Datadog Security Labs)](https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/)
- [The Telnyx SDK on PyPI Compromise and the 2026 TeamPCP Supply Chain Attacks (Akamai)](https://www.akamai.com/blog/security-research/2026/mar/telnyx-sdk-pypi-2026-teampcp-supply-chain-attacks)
- [TeamPCP: Trojanized Security Tools Backdoor AI Infrastructure (Cloud Security Alliance)](https://labs.cloudsecurityalliance.org/research/csa-research-note-teampcp-ai-infra-supply-chain-20260406-csa/)
- [Shai-Hulud ChainDrop npm supply chain (Elastic Security Labs)](https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain)
- [Tracking Shai-Hulud: Inside the ChainDrop npm worm (Zscaler)](https://zscaler.com/blogs/security-research/tracking-shai-hulud-inside-chaindrop-npm-worm)
- [ChainDrop npm worm (StepSecurity)](https://stepsecurity.io/blog/chaindrop-npm-worm)
- [axios npm package compromised, supply chain attack delivers cross-platform RAT (Snyk)](https://snyk.io/blog/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform)
- [Hackers compromise axios npm package to drop cross-platform malware (BleepingComputer)](https://www.bleepingcomputer.com/news/security/hackers-compromise-axios-npm-package-to-drop-cross-platform-malware/amp/)
- [Miasma Worm Reaches Microsoft Azure and PyPI: 73 Repositories Disabled (Phoenix Security)](https://phoenix.security/miasma-azure-hades-pypi-supply-chain-worm-2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3729