For years the industry's mental model of a software supply chain attack was SolarWinds: a patient state operation that burrows into a vendor and rides its update mechanism into thousands of networks. Google Threat Intelligence Group says that picture is now out of date. The volume has moved to open source, where poisoning a package requires far less planning and money than compromising a software vendor, and reaches just as far.
GTIG assesses with high confidence that very large scale open source supply chain campaigns grew significantly through 2025 and early 2026, and expects other actors to copy the playbook. Independent numbers back the trend: the Open Source Security Foundation counted a 1,444 percent rise in reported malicious open source packages between 2024 and 2025.
What the campaigns look like
Between February and May 2026, the group tracked as UNC6780, better known as TeamPCP, ran extensive compromises across PyPI, npm and Docker Hub. Entry points varied, but one recurring technique was abusing the pull_request_target trigger in GitHub Actions, a setting that runs workflow code with access to the base repository's secrets and write permissions. The crew used the poisoned packages to deploy credential stealers including SANDCLOCK, then monetized the harvested secrets by selling them or handing them to extortion crews, a pattern IntelFusions covered when the Vect ransomware operation partnered with TeamPCP. In incident response work, GTIG saw the group pivot from compromised AI software into wider network environments.
March 2026 produced the clearest illustration of reach. A malicious dependency appeared in axios, one of the most widely used JavaScript HTTP libraries, after the maintainer's account was compromised through social engineering. The dependency dropped a backdoor GTIG calls WAVESHAPER.V2, and the activity is attributed to the North Korean actor MIDNIGHT NEPTUNE, formerly tracked as UNC1069. The bad versions were pulled from npm within three hours. That was still enough: axios sees over 100 million downloads a week and is itself a dependency of tens of thousands of other packages, and GTIG ended up supporting affected customers across 15 industry verticals in 13 countries. The same GitHub Actions weakness featured in an earlier npm backdoor campaign we reported this month.
The classic attack has not disappeared, it has narrowed
GTIG assesses with high confidence that traditional supply chain compromise, meaning tampering with source code or update and distribution mechanisms, remains rare. The cases it did find were mostly espionage with deliberately narrow targeting. North Korean actor UNC4899 social engineered a developer at a web3 organization and injected code into frontend systems to alter transactions involving a multi signature wallet, a single victim operation that ended in an estimated 1.4 billion dollar cryptocurrency theft. GTIG also attributes the June to December 2025 compromise of Notepad++ update hosting to UNC6688, and an early 2026 compromise of DAEMON Tools installers to UNC6863, which used a profiling implant called SLICKDEMON to filter for interesting victims before delivering a loader and a QUIC based remote access trojan against government and scientific targets.
What to do about it
GTIG's recommendations start with knowing what you actually run: a tiered, continuously updated inventory of applications, third party vendors and services, ranked by operational importance so single points of failure are visible. On top of that, automated software bills of materials for internal and third party packages, so newly disclosed issues can be cross referenced against live code inventories rather than guessed at.
The team also expects AI to accelerate the problem. Malicious packages have already been planted in open source AI communities and Model Context Protocol packages, and there is at least one documented case of an AI coding agent co-authoring a commit that pulled a North Korean crypto themed malicious package into a legitimate trading project.
The analysis was published on 30 July 2026 by Kelli Vanderlee and Stuart Carrera of Google Threat Intelligence Group and Mandiant.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.