Supply Chain Compromise Trends 2025-2026: TeamPCP (UNC6780) package poisoning, axios npm compromise (MIDNIGHT NEPTUNE / UNC1069), and mitigation guidance

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5891 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5891 npm Postinstall Dropper Execution (axios 1.14.1/0.30.4 plain-crypto-js SILKBELL setup.js) — Exploitation

Detects the initial-access chain of the axios npm compromise (MIDNIGHT NEPTUNE / UNC1069, T1195.001): a process whose working directory is node_modules/plain-crypto-js running 'node setup.js' (the SILKBELL dropper triggered by the postinstall hook), or any command line that installs axios@1.14.1, axios@0.30.4 or plain-crypto-js. Behaviour-first: the working-directory plus setup.js pairing is independent of file hashes and C2 infrastructure, so it survives IOC rotation. Any hit means the host executed attacker code and should be treated as compromised (rebuild and rotate credentials and CI secrets).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.001, T1059.007
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (CurrentDirectory="*node_modules*plain-crypto-js*" OR CommandLine="*plain-crypto-js*" OR CommandLine="*axios@1.14.1*" OR CommandLine="*axios@0.30.4*")
| eval postinstall_hook=if(match(CommandLine,"(?i)node([.]exe)?[^a-z0-9]+setup[.]js") AND like(CurrentDirectory,"%plain-crypto-js%"),1,0)
| eval pinned_package_ref=if(match(CommandLine,"(?i)(axios@(1[.]14[.]1|0[.]30[.]4)|plain-crypto-js)"),1,0)
| eval signal=case(postinstall_hook=1,"silkbell_postinstall_setup_js",pinned_package_ref=1,"malicious_package_version_referenced",true(),"process_started_in_plain_crypto_js_dir")
| stats count min(_time) as first_seen max(_time) as last_seen values(signal) as signals values(CommandLine) as command_lines values(ParentImage) as parent_images values(User) as users by host
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let ioc_hashes = dynamic(["e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09","58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668","617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101","fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf","92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a","ed8560c1ac7ceb6983ba995124d5917dc1a00288912387a6389296637d5f815c"]);
let script_children = dynamic(["powershell.exe","cmd.exe","wt.exe","cscript.exe","wscript.exe","curl.exe","sh","bash","zsh","python","python3","osascript","curl","nohup"]);
union
(DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine matches regex @"(axios@(1[.]14[.]1|0[.]30[.]4)|plain-crypto-js|@shadanai/openclaw|@qqbrowser/openclaw-qbot|@bitwarden/cli@2026[.]4[.]0|litellm==1[.]82[.][78])"
   or (InitiatingProcessFileName in~ ("node","node.exe") and InitiatingProcessCommandLine has "setup.js" and FileName in~ (script_children))
| project Timestamp, DeviceName, Account = AccountName, Signal = "npm_install_or_postinstall_exec", FileName, FolderPath, CommandLine = ProcessCommandLine, ParentProcess = InitiatingProcessFileName, SHA256),
(DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated","FileModified","FileRenamed")
| where (FolderPath has "node_modules" and FolderPath has "plain-crypto-js") or FileName =~ "litellm_init.pth" or SHA256 in (ioc_hashes)
| project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Signal = "malicious_package_or_payload_on_disk", FileName, FolderPath, CommandLine = InitiatingProcessCommandLine, ParentProcess = InitiatingProcessFileName, SHA256)
| order by Timestamp desc

Sigma

title: Malicious plain-crypto-js Package or litellm_init.pth Written to Disk
id: 7d1f3a64-2b8e-4c09-9a5d-61e0f4c8b2a7
status: experimental
description: Detects creation of files under a node_modules/plain-crypto-js directory (the malicious dependency injected into axios 1.14.1 and 0.30.4, whose postinstall hook runs the SILKBELL dropper setup.js and delivers WAVESHAPER.V2) or the litellm_init.pth file dropped by TeamPCP-poisoned LiteLLM releases. TL-2026-5891.
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package
  - https://socket.dev/blog/axios-npm-package-compromised
  - https://github.com/axios/axios/issues/10636
  - https://cloud.google.com/blog/topics/threat-intelligence/mitigation-guidance-for-supply-chain-compromise/
author: Threadlinqs Team
date: 2026-11-12
tags:
  - attack.initial-access
  - attack.t1195.001
  - attack.execution
  - attack.t1059.007
logsource:
  category: file_event
  product: windows
detection:
  selection_plain_crypto_js:
    TargetFilename|contains|all:
      - 'node_modules'
      - 'plain-crypto-js'
  selection_litellm_pth:
    TargetFilename|endswith: 'litellm_init.pth'
  condition: 1 of selection_*
falsepositives:
  - Security researchers or malware analysts deliberately installing plain-crypto-js in a sandbox
  - Software composition analysis tools that unpack the npm tarball for inspection
level: high

Known false positives:

• Security researchers or analysts deliberately installing axios 1.14.1/0.30.4 or plain-crypto-js in a sandbox to reproduce the incident
• Rollback or remediation scripts that reference the malicious versions on the command line while pinning axios to a safe release (for example 'npm install axios@1.14.0' after removing 1.14.1)
• SCA or SBOM tooling that unpacks npm tarballs and runs inside a node_modules directory

Tuning notes: Restrict to developer workstations and CI runners to cut noise. Exclude the hosts and accounts of your remediation and security-research teams. If Sysmon does not log CurrentDirectory, rely on the pinned_package_ref signal and the KQL file-event variant. Any plain-crypto-js directory is anomalous because axios never legitimately depended on it; treat first_seen as the start of the exposure window and rotate every secret reachable from the host.

• 🔒 TL-2026-5891 Poisoned Package Install and Postinstall Child Process (axios, plain-crypto-js, LiteLLM, Bitwarden CLI) — Exploitation · unlock with TL Creds
• 🔒 TL-2026-5891 WAVESHAPER.V2 Payload Execution, Run-Key Persistence and Self-Deletion Across Windows, macOS and Linux — Post-Exploitation · unlock with TL Creds
• 🔒 TL-2026-5891 WAVESHAPER.V2 C2 Network Beaconing to [indicator]:8000 — C2 · unlock with TL Creds
• 🔒 TL-2026-5891 Malicious plain-crypto-js Package or [indicator] Written to Disk — Exploitation · unlock with TL Creds
• 🔒 TL-2026-5891 Renamed PowerShell Executed as ProgramData wt.exe (WAVESHAPER.V2 Windows Stage) — Post-Exploitation · unlock with TL Creds
• 🔒 TL-2026-5891 WAVESHAPER.V2 C2 Beacon via Web Proxy to [indicator]:8000/6202033 — C2 · unlock with TL Creds
• 🔒 TL-2026-5891 WAVESHAPER.V2 Windows Stage — Renamed PowerShell wt.exe, system.bat and Run-Key Persistence — Post-Exploitation · unlock with TL Creds
• 🔒 TL-2026-5891 WAVESHAPER.V2 C2 Beaconing to [indicator]:8000 and Community-Observed Infrastructure — C2 · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 28 indicators of compromise for TL-2026-5891.

Sample indicators (3 of 28)

• IP address: 142.11.206[.]73
• Domain: sfrclak[.]com
• File hash: fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf

Defanged, TLP:CLEAR. Full set of 28 indicators: unlock with TL Creds.

Community OSINT corroboration

6 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

Google Threat Intelligence Group (GTIG) published 'Batten Down Your Packages' on 2026-07-30. It assesses that open-source dependency and developer-tool compromise (T1195.001) was the most impactful form of supply chain attack in 2025 and early 2026, while classic compromise of vendor update or distribution mechanisms (T1195.002) is rarer. GTIG cites OpenSSF data showing a 1,444% rise in malicious open-source packages from 2024 to 2025 and expects AI to accelerate the trend.

UNC6780 (TeamPCP) was active from February to May 2026 across PyPI, npm and Docker Hub. GTIG says entry came partly through abuse of the GitHub Actions pull_request_target trigger to obtain base-repository secrets and write permissions. Poisoned packages deployed credential stealers including SANDCLOCK, and the group attempted to pivot from compromised AI software into wider networks. Stolen credentials were sold directly or passed to ransomware and extortion groups. Secondary reporting (Cloud Security Alliance, SANS, FBI IC3) names the Trivy, trivy-action and setup-trivy compromise starting 2026-03-19 (CVE-2026-33634), the CanisterWorm npm worm with ICP-canister C2, and later compromises of Checkmarx KICS, LiteLLM 1.82.7/1.82.8, the Telnyx SDK, @bitwarden/cli 2026.4.0 and the Nx Console VS Code extension. These details come from secondary sources and were not independently verified.

On 2026-03-31 (00:21 to 03:15 UTC) a MIDNIGHT NEPTUNE (formerly UNC1069, North Korea-nexus) operator published axios 1.14.1 and 0.30.4 using a compromised maintainer account. Both versions added the dependency plain-crypto-js 4.2.1, whose postinstall hook runs the SILKBELL dropper (setup.js). SILKBELL uses XOR/Base64 string obfuscation, selects a per-OS payload (PowerShell via a renamed powershell.exe as %PROGRAMDATA%\wt.exe on Windows, a Mach-O at /Library/Caches/com.apple.act.mond on macOS, /tmp/ld.py on Linux), then deletes itself and restores package.json. The payload is WAVESHAPER.V2, which beacons every 60 seconds as Base64 JSON over HTTP to sfrclak.com:8000/6202033 and supports kill, rundir, runscript and peinject commands. The axios maintainer reports a roughly two-week social-engineering campaign (fake company founder, Slack workspace, Teams call, RAT installed as a 'missing' component); the post-mortem does not explain how 2FA was bypassed. Malicious versions were live about three hours.

Other incidents GTIG lists: UNC6688 Notepad++ update hosting (Jun-Dec 2025), UNC6863 DAEMON Tools installer, UNC4899 Bybit/Safe wallet frontend tampering (about $1.4B), SHADOWLADDER (SectopRAT) via ClickFix on car dealership sites, and web skimmers on eCommerce sites. Malware tied to related activity: SLICKDEMON (reconnaissance), BADFALL (shellcode loader bridging to QUIC RAT). The article lists no IOCs for TeamPCP; the IOCs here for axios come from the GTIG axios post, Socket and the axios post-mortem. GTIG mitigation guidance: minimumReleaseAge of at least 1440 minutes, ignore-scripts=true, npm ci, private pip index, short-lived OIDC tokens instead of PATs, restricting pull_request_target, ephemeral runners with egress allow-lists, quarantine gates for new releases, SBOM/ABOM inventories, OSV-Scanner and signature verification.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036.003 Rename Legitimate Utilities; T1055.002 Portable Executable Injection; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information

Discovery

T1057 Process Discovery; T1082 System Information Discovery

Execution

T1059.001 PowerShell; T1059.002 AppleScript; T1059.004 Unix Shell; T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols

Initial Access

T1078 Valid Accounts; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain; T1566.003 Spearphishing via Service

Persistence

T1547.001 Registry Run Keys / Startup Folder

Credential Access

T1552 Unsecured Credentials

Remediation

Patches

• Upgrade to npm v12 (lifecycle scripts disabled by default) and use Dependabot's default cooldown
• PyPI now rejects new file uploads to releases older than 14 days (July 2026)

Immediate actions

• Search all lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock) for axios 1.14.1 / 0.30.4 and plain-crypto-js 4.2.0 / 4.2.1
• Pin axios to 1.14.0 or earlier (0.30.3 or earlier for 0.x), delete node_modules/plain-crypto-js, and clear npm/yarn/pnpm caches
• Treat any host that ran plain-crypto-js as compromised: rebuild from a known-good state and rotate all credentials and CI secrets exposed to it
• Block sfrclak.com, 142.11.206.73 and 23.254.167.216 and hunt egress to port 8000
• Review workflows pinned to mutable tags (Trivy, KICS, other third-party Actions) and rotate secrets used in runs during exposure windows

Workarounds

• Point pip at a vetted private --index-url instead of public PyPI
• Store plaintext secrets in an OS keychain or vault (for example aws-vault) rather than on developer disks or environment variables

Longer-term hardening

• Set minimumReleaseAge to at least 1440 minutes for npm/pnpm and route packages through quarantine gates with cooling windows
• Set ignore-scripts=true in repository .npmrc, use onlyBuiltDependencies allowlists, and install with npm ci
• Replace long-lived PATs with GitHub Apps or short-lived OIDC tokens; use FIDO2 SSH keys and OIDC-based publishing
• Restrict pull_request_target and repository_dispatch triggers; use ephemeral single-use runners with allow-listed egress
• Maintain SBOM and ABOM inventories, integrate OSV-Scanner in CI/CD, verify signatures and hashes, and audit npm maintainer recovery email domains
• Run tabletop exercises for upstream package takeover, dependency confusion, pipeline harvesting and developer workstation compromise

Affected and fixed versions

• axios — axios (npm)
  Vulnerable versions: 1.14.1; 0.30.4
  Fixed in: 1.14.0 or earlier; 0.30.3 or earlier
• npm — plain-crypto-js (npm)
  Vulnerable versions: 4.2.0; 4.2.1
• Aqua Security — Trivy / trivy-action / setup-trivy
  Vulnerable versions: v0.69.4-v0.69.6
• BerriAI — LiteLLM (PyPI)
  Vulnerable versions: 1.82.7; 1.82.8
• Bitwarden — @bitwarden/cli (npm)
  Vulnerable versions: 2026.4.0
• Checkmarx — KICS (Docker Hub image)

Timeline

• 2025-06-01 UNC6688 begins compromising Notepad++ update hosting infrastructure (Jun-Dec 2025), affecting organizations in South Korea and France (month approximate per GTIG).
• 2026-02-01 UNC6780 (TeamPCP) campaign against PyPI, npm and Docker Hub begins (Feb-May 2026 per GTIG; month approximate), abusing pull_request_target to obtain secrets.
• 2026-03-19 TeamPCP poisons aquasecurity/trivy-action and setup-trivy via mutable tags (Trivy v0.69.4 onward, CVE-2026-33634), deploying SANDCLOCK; exposure window runs to 2026-03-24 (CSA, secondary source).
• 2026-03-30 plain-crypto-js 4.2.1 (malicious) published to npm at about 23:59 UTC; Socket flags it about six minutes later. A clean 4.2.0 decoy had been published earlier.
• 2026-03-31 GTIG attributes the axios compromise to UNC1069 (North Korea-nexus), citing WAVESHAPER code and infrastructure overlap with earlier UNC1069 activity.
• 2026-03-31 npm removes the malicious axios versions at 03:15 UTC and plain-crypto-js at 03:29 UTC after a collaborator contacted npm; versions were live about three hours.
• 2026-03-31 axios 1.14.1 published at 00:21 UTC and 0.30.4 at about 01:00 UTC from a compromised maintainer account, adding plain-crypto-js 4.2.1 whose postinstall hook runs the SILKBELL dropper and WAVESHAPER.V2.
• 2026-04-21 After a 26-day pause, TeamPCP compromises the Checkmarx KICS Docker Hub image, @bitwarden/cli 2026.4.0 (about 90 minutes live) and xinference on PyPI (April 21-22, SANS/CSA, secondary sources).
• 2026-05-18 Trojanized Nx Console VS Code extension live for 18 minutes (12:30-12:48 UTC); CSA reports a GitHub employee installed it and about 3,800 internal repositories were exfiltrated May 18-20.
• 2026-07-02 FBI IC3 publishes an advisory (CSA 260702) on TeamPCP compromise of developer tools to steal cloud credentials (document text not retrievable; title per search result).
• 2026-07-22 PyPI begins rejecting new file uploads to releases older than 14 days, one of the platform guardrails GTIG cites.
• 2026-07-30 GTIG publishes 'Batten Down Your Packages' summarizing 2025-2026 supply chain compromises and hardening guidance.

Sources cited

Showing 15 of 16 sources, primary sources first.

• FBI IC3 advisory on TeamPCP (CSA 260702) ic3.gov · Advisory · 2026-07-02
• FBI: North Korea responsible for $1.5 billion Bybit hack fbi.gov · Advisory · 2025-02-26
• Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise (GTIG) Google Cloud · Vendor report · 2026-07-30
• North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package (GTIG) Google Cloud · Vendor report · 2026-03-31
• Socket: axios npm package compromised socket.dev · Research · 2026-03-31
• CSA Research Note: TeamPCP (UNC6780) AI developer supply chain labs.cloudsecurityalliance.org · Research · 2026-05-20
• Tenable FAQ: Axios npm supply chain attack by UNC1069 Tenable · Vendor report · 2026-04-01
• GTIG: UNC1069 targets cryptocurrency with AI social engineering Google Cloud · Vendor report
• Securelist: DAEMON Tools backdoor Kaspersky Securelist · Research
• Notepad++ hijacked incident info update notepad-plus-plus.org · Vendor report
• PyPI: releases now reject new files after 14 days blog.pypi.org · Vendor report · 2026-07-22
• GitHub: the case for a cooldown (Dependabot) github.blog · Vendor report
• axios post-mortem (GitHub issue #10636) GitHub · Code repository · 2026-04-01
• Wiz SITF: SDLC threat framework GitHub · Code repository
• SANS ISC: TeamPCP Supply Chain Campaign Update 007 isc.sans.edu · Blog

More in supply chain

• Cursor Supply-Chain Compromise: Leaked Fireworks AI Key Leads to Backdoored Anthropic.claude-code Extension (2.1.312/2.1.313) in Cursor Marketplace Cache
• nDiligence 'Attack the Glass' (ATG): Runtime Client-Side Rendering Supply-Chain Vulnerability Class Across 50 Platform Types
• Binance Hack: Tampered Homebrew Package Delivers macOS Stealer; Infostealers and AI-Powered Profiling Feed Social Engineering (TraderTraitor attribution)
• wfx-loot: GitHub Actions CI secret stealer pushed to public repositories using stolen GitHub credentials
• Quantum Systems QBase ground-control software update reportedly malware-laden; Bundeswehr drones grounded as precaution

More from UNC6780

• Google Cloud Threat Intelligence: Supply Chain Compromise Campaigns and Mitigation Guidance (2025-2026)
• Miasma Supply Chain Attack Toolkit Open-Sourced on GitHub (Shai-Hulud / Mini Shai-Hulud Variant)
• GTIG AI Threat Tracker (May 2026) — First AI-Developed Zero-Day Exploit (2FA Bypass), PROMPTFLUX/HONESTCUE/CANFAIL/LONGSTREAM/PROMPTSPY AI-Enabled Malware, and APT27/APT45/UNC2814/UNC5673/UNC6201/TeamPCP AI-Augmented Operations
• lightning PyPI Package Compromise — Versions 2.6.2 & 2.6.3 Execute Bun-Based JavaScript Credential Stealer on Import (Shai-Hulud-Overlapping)

Other reports on CVE-2026-33634

• TeamPCP LiteLLM Supply Chain Attack — Trojaned PyPI Packages (v1.82.7/1.82.8) with Multi-Stage C2 Payload
• Trivy Supply Chain Compromise — TeamPCP Credential-Stealing Malware Injected into CI/CD Pipelines (CVE-2026-33634)

Previous and next in supply chain

• Post-Training Supply Chain Backdoors Hijack Coding Agents (Dataset and Model Poisoning) Previous report
• TOPHIT: One-operator npm typosquat flood (@prime0 scope, 85 packages) co-hosted with GPU-cryptojacking C2 Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages