# Supply Chain Compromise Trends 2025-2026: TeamPCP (UNC6780) package poisoning, axios npm compromise (MIDNIGHT NEPTUNE / UNC1069), and mitigation guidance

> GTIG reports that the most impactful supply chain compromises of 2025 and early 2026 targeted code repositories, dependencies and developer tools. UNC6780 (TeamPCP) poisoned PyPI, npm, Docker Hub and GitHub Actions components (Feb-May 2026) with the SANDCLOCK credential stealer, and North Korea-nexus MIDNIGHT NEPTUNE (UNC1069) hijacked an axios maintainer account on 2026-03-31 to ship the WAVESHAPER.V2 backdoor.

- **Published:** 2026-11-12T20:51:26Z
- **Last reviewed:** 2026-11-12T20:51:26Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5891
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5891.png
- **ID:** TL-2026-5891
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** UNC6780 (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 28 (3 shown free below)
- **CVEs:** CVE-2026-33634

## Description

Google Threat Intelligence Group (GTIG) published 'Batten Down Your Packages' on 2026-07-30. It assesses that open-source dependency and developer-tool compromise (T1195.001) was the most impactful form of supply chain attack in 2025 and early 2026, while classic compromise of vendor update or distribution mechanisms (T1195.002) is rarer. GTIG cites OpenSSF data showing a 1,444% rise in malicious open-source packages from 2024 to 2025 and expects AI to accelerate the trend.

UNC6780 (TeamPCP) was active from February to May 2026 across PyPI, npm and Docker Hub. GTIG says entry came partly through abuse of the GitHub Actions pull_request_target trigger to obtain base-repository secrets and write permissions. Poisoned packages deployed credential stealers including SANDCLOCK, and the group attempted to pivot from compromised AI software into wider networks. Stolen credentials were sold directly or passed to ransomware and extortion groups. Secondary reporting (Cloud Security Alliance, SANS, FBI IC3) names the Trivy, trivy-action and setup-trivy compromise starting 2026-03-19 (CVE-2026-33634), the CanisterWorm npm worm with ICP-canister C2, and later compromises of Checkmarx KICS, LiteLLM 1.82.7/1.82.8, the Telnyx SDK, @bitwarden/cli 2026.4.0 and the Nx Console VS Code extension. These details come from secondary sources and were not independently verified.

On 2026-03-31 (00:21 to 03:15 UTC) a MIDNIGHT NEPTUNE (formerly UNC1069, North Korea-nexus) operator published axios 1.14.1 and 0.30.4 using a compromised maintainer account. Both versions added the dependency plain-crypto-js 4.2.1, whose postinstall hook runs the SILKBELL dropper (setup.js). SILKBELL uses XOR/Base64 string obfuscation, selects a per-OS payload (PowerShell via a renamed powershell.exe as %PROGRAMDATA%\wt.exe on Windows, a Mach-O at /Library/Caches/com.apple.act.mond on macOS, /tmp/ld.py on Linux), then deletes itself and restores package.json. The payload is WAVESHAPER.V2, which beacons every 60 seconds as Base64 JSON over HTTP to sfrclak.com:8000/6202033 and supports kill, rundir, runscript and peinject commands. The axios maintainer reports a roughly two-week social-engineering campaign (fake company founder, Slack workspace, Teams call, RAT installed as a 'missing' component); the post-mortem does not explain how 2FA was bypassed. Malicious versions were live about three hours.

Other incidents GTIG lists: UNC6688 Notepad++ update hosting (Jun-Dec 2025), UNC6863 DAEMON Tools installer, UNC4899 Bybit/Safe wallet frontend tampering (about $1.4B), SHADOWLADDER (SectopRAT) via ClickFix on car dealership sites, and web skimmers on eCommerce sites. Malware tied to related activity: SLICKDEMON (reconnaissance), BADFALL (shellcode loader bridging to QUIC RAT). The article lists no IOCs for TeamPCP; the IOCs here for axios come from the GTIG axios post, Socket and the axios post-mortem. GTIG mitigation guidance: minimumReleaseAge of at least 1440 minutes, ignore-scripts=true, npm ci, private pip index, short-lived OIDC tokens instead of PATs, restricting pull_request_target, ephemeral runners with egress allow-lists, quarantine gates for new releases, SBOM/ABOM inventories, OSV-Scanner and signature verification.

## MITRE ATT&CK

- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1078 Valid Accounts
- T1566.003 Spearphishing via Service
- T1059.007 JavaScript
- T1059.001 PowerShell
- T1059.004 Unix Shell
- T1059.002 AppleScript
- T1547.001 Registry Run Keys / Startup Folder
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.003 Rename Legitimate Utilities
- T1070.004 File Deletion
- T1055.002 Portable Executable Injection
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1057 Process Discovery
- T1071.001 Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5891 npm Postinstall Dropper Execution (axios 1.14.1/0.30.4 plain-crypto-js SILKBELL setup.js) — Exploitation** (`TL-2026-5891-SPL-001`)

Detects the initial-access chain of the axios npm compromise (MIDNIGHT NEPTUNE / UNC1069, T1195.001): a process whose working directory is node_modules/plain-crypto-js running 'node setup.js' (the SILKBELL dropper triggered by the postinstall hook), or any command line that installs axios@1.14.1, axios@0.30.4 or plain-crypto-js. Behaviour-first: the working-directory plus setup.js pairing is independent of file hashes and C2 infrastructure, so it survives IOC rotation. Any hit means the host executed attacker code and should be treated as compromised (rebuild and rotate credentials and CI secrets).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.001, T1059.007
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (CurrentDirectory="*node_modules*plain-crypto-js*" OR CommandLine="*plain-crypto-js*" OR CommandLine="*axios@1.14.1*" OR CommandLine="*axios@0.30.4*")
| eval postinstall_hook=if(match(CommandLine,"(?i)node([.]exe)?[^a-z0-9]+setup[.]js") AND like(CurrentDirectory,"%plain-crypto-js%"),1,0)
| eval pinned_package_ref=if(match(CommandLine,"(?i)(axios@(1[.]14[.]1|0[.]30[.]4)|plain-crypto-js)"),1,0)
| eval signal=case(postinstall_hook=1,"silkbell_postinstall_setup_js",pinned_package_ref=1,"malicious_package_version_referenced",true(),"process_started_in_plain_crypto_js_dir")
| stats count min(_time) as first_seen max(_time) as last_seen values(signal) as signals values(CommandLine) as command_lines values(ParentImage) as parent_images values(User) as users by host
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let ioc_hashes = dynamic(["e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09","58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668","617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101","fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf","92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a","ed8560c1ac7ceb6983ba995124d5917dc1a00288912387a6389296637d5f815c"]);
let script_children = dynamic(["powershell.exe","cmd.exe","wt.exe","cscript.exe","wscript.exe","curl.exe","sh","bash","zsh","python","python3","osascript","curl","nohup"]);
union
(DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine matches regex @"(axios@(1[.]14[.]1|0[.]30[.]4)|plain-crypto-js|@shadanai/openclaw|@qqbrowser/openclaw-qbot|@bitwarden/cli@2026[.]4[.]0|litellm==1[.]82[.][78])"
   or (InitiatingProcessFileName in~ ("node","node.exe") and InitiatingProcessCommandLine has "setup.js" and FileName in~ (script_children))
| project Timestamp, DeviceName, Account = AccountName, Signal = "npm_install_or_postinstall_exec", FileName, FolderPath, CommandLine = ProcessCommandLine, ParentProcess = InitiatingProcessFileName, SHA256),
(DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated","FileModified","FileRenamed")
| where (FolderPath has "node_modules" and FolderPath has "plain-crypto-js") or FileName =~ "litellm_init.pth" or SHA256 in (ioc_hashes)
| project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Signal = "malicious_package_or_payload_on_disk", FileName, FolderPath, CommandLine = InitiatingProcessCommandLine, ParentProcess = InitiatingProcessFileName, SHA256)
| order by Timestamp desc
```

### Sigma

```yaml
title: Malicious plain-crypto-js Package or litellm_init.pth Written to Disk
id: 7d1f3a64-2b8e-4c09-9a5d-61e0f4c8b2a7
status: experimental
description: Detects creation of files under a node_modules/plain-crypto-js directory (the malicious dependency injected into axios 1.14.1 and 0.30.4, whose postinstall hook runs the SILKBELL dropper setup.js and delivers WAVESHAPER.V2) or the litellm_init.pth file dropped by TeamPCP-poisoned LiteLLM releases. TL-2026-5891.
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package
  - https://socket.dev/blog/axios-npm-package-compromised
  - https://github.com/axios/axios/issues/10636
  - https://cloud.google.com/blog/topics/threat-intelligence/mitigation-guidance-for-supply-chain-compromise/
author: Threadlinqs Team
date: 2026-11-12
tags:
  - attack.initial-access
  - attack.t1195.001
  - attack.execution
  - attack.t1059.007
logsource:
  category: file_event
  product: windows
detection:
  selection_plain_crypto_js:
    TargetFilename|contains|all:
      - 'node_modules'
      - 'plain-crypto-js'
  selection_litellm_pth:
    TargetFilename|endswith: 'litellm_init.pth'
  condition: 1 of selection_*
falsepositives:
  - Security researchers or malware analysts deliberately installing plain-crypto-js in a sandbox
  - Software composition analysis tools that unpack the npm tarball for inspection
level: high
```

**Known false positives:**

- Security researchers or analysts deliberately installing axios 1.14.1/0.30.4 or plain-crypto-js in a sandbox to reproduce the incident
- Rollback or remediation scripts that reference the malicious versions on the command line while pinning axios to a safe release (for example 'npm install axios@1.14.0' after removing 1.14.1)
- SCA or SBOM tooling that unpacks npm tarballs and runs inside a node_modules directory

**Tuning notes:** Restrict to developer workstations and CI runners to cut noise. Exclude the hosts and accounts of your remediation and security-research teams. If Sysmon does not log CurrentDirectory, rely on the pinned_package_ref signal and the KQL file-event variant. Any plain-crypto-js directory is anomalous because axios never legitimately depended on it; treat first_seen as the start of the exposure window and rotate every secret reachable from the host.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5891 Poisoned Package Install and Postinstall Child Process (axios, plain-crypto-js, LiteLLM, Bitwarden CLI) — Exploitation (locked: unlock with TL Creds)
- TL-2026-5891 WAVESHAPER.V2 Payload Execution, Run-Key Persistence and Self-Deletion Across Windows, macOS and Linux — Post-Exploitation (locked: unlock with TL Creds)
- TL-2026-5891 WAVESHAPER.V2 C2 Network Beaconing to [indicator]:8000 — C2 (locked: unlock with TL Creds)
- TL-2026-5891 Malicious plain-crypto-js Package or [indicator] Written to Disk — Exploitation (locked: unlock with TL Creds)
- TL-2026-5891 Renamed PowerShell Executed as ProgramData wt.exe (WAVESHAPER.V2 Windows Stage) — Post-Exploitation (locked: unlock with TL Creds)
- TL-2026-5891 WAVESHAPER.V2 C2 Beacon via Web Proxy to [indicator]:8000/6202033 — C2 (locked: unlock with TL Creds)
- TL-2026-5891 WAVESHAPER.V2 Windows Stage — Renamed PowerShell wt.exe, system.bat and Run-Key Persistence — Post-Exploitation (locked: unlock with TL Creds)
- TL-2026-5891 WAVESHAPER.V2 C2 Beaconing to [indicator]:8000 and Community-Observed Infrastructure — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 28)

Defanged, TLP:CLEAR.

- IP address: `142.11.206[.]73`
- Domain: `sfrclak[.]com`
- File hash: `fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf`

Full set of 28 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise (GTIG)](https://cloud.google.com/blog/topics/threat-intelligence/mitigation-guidance-for-supply-chain-compromise/)
- [North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package (GTIG)](https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package)
- [Socket: axios npm package compromised](https://socket.dev/blog/axios-npm-package-compromised)
- [axios post-mortem (GitHub issue #10636)](https://github.com/axios/axios/issues/10636)
- [CSA Research Note: TeamPCP (UNC6780) AI developer supply chain](https://labs.cloudsecurityalliance.org/research/csa-research-note-teampcp-unc6780-ai-developer-supply-chain/)
- [FBI IC3 advisory on TeamPCP (CSA 260702)](https://www.ic3.gov/CSA/2026/260702.pdf)
- [Tenable FAQ: Axios npm supply chain attack by UNC1069](https://tenable.com/blog/faq-about-the-axios-npm-supply-chain-attack-by-north-korea-nexus-threat-actor-unc1069)
- [The Hacker News: Google attributes axios npm supply chain attack](https://thehackernews.com/2026/04/google-attributes-axios-npm-supply.html)
- [GTIG: UNC1069 targets cryptocurrency with AI social engineering](https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering)
- [SANS ISC: TeamPCP Supply Chain Campaign Update 007](https://isc.sans.edu/diary/32880)
- [Securelist: DAEMON Tools backdoor](https://securelist.com/tr/daemon-tools-backdoor/119654/)
- [Notepad++ hijacked incident info update](https://notepad-plus-plus.org/news/hijacked-incident-info-update/)
- [FBI: North Korea responsible for $1.5 billion Bybit hack](https://www.fbi.gov/investigate/cyber/alerts/2025/north-korea-responsible-for-1-5-billion-bybit-hack)
- [PyPI: releases now reject new files after 14 days](https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days/)
- [GitHub: the case for a cooldown (Dependabot)](https://github.blog/security/supply-chain-security/the-case-for-a-cooldown-why-dependabot-now-waits-before-issuing-version-updates/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5891