Defending Against the 1,444% Surge in Open Source Supply Chain Attacks

Growing Volatility in the Open Source Ecosystem

For years, the cybersecurity industry focused on high-profile Supply Chain Attack events such as the 2020 SolarWinds incident. However, according to Google Threat Intelligence Group (GTIG), there has been a tectonic shift toward targeting open source software repositories. Statistics from the Open Source Security Foundation (OpenSSF) reveal that the number of malicious open source packages identified increased by 1,444% between 2024 and 2025. This explosion in activity underscores a significant expansion in the use of this APT TTP to achieve initial access and persistence.

Unlike traditional supply chain compromises that target proprietary update mechanisms, open source attacks offer efficiency and scale with relatively low resource requirements. While these attacks are often noisier and discovered more quickly, their immediate impact can be devastating. GTIG assessments suggest that threat actors are increasingly leveraging automation and iterative compromises to maintain a foothold in global development pipelines.

UNC6780 and the Abuse of GitHub Actions Triggers

Between February and May 2026, the threat group UNC6780 (also known as TeamPCP) conducted extensive campaigns targeting ecosystems such as PyPI, npm, and Docker Hub. A primary Initial Access vector involved the abuse of the pull_request_target GitHub Actions trigger. By exploiting this trigger, the actor obtained base repository secrets and write permissions, allowing them to inject malicious code directly into trusted repositories.

Defenders researching how to detect PyPI and npm supply chain exploits should note that UNC6780 typically used compromised packages to deploy credential stealers, specifically SANDCLOCK. These tools are designed to harvest high-value secrets which are then monetized through direct sale or shared with Ransomware and extortion groups. The group has also been observed pivoting from compromised artificial intelligence (AI) software into broader enterprise networks.

North Korean Activity: The Axios Compromise

In March 2026, GTIG observed a major incident involving the axios npm package, which serves over 100 million weekly downloads. The North Korean actor MIDNIGHT NEPTUNE (formerly UNC1069) utilized social engineering to compromise a maintainer account. Once access was secured, the actor published updated versions of the package containing a malicious dependency.

This dependency functioned as a dropper for the WAVESHAPER.V2 backdoor, facilitating remote access and C2 communication. Although the malicious versions were removed within three hours, the scale of the compromise was vast due to the package’s status as a dependency for tens of thousands of other projects. This incident highlights the fragility of the open source dependency graph and the speed at which a single compromised account can affect global infrastructure.

The Impact of AI on Supply Chain Security

GTIG anticipates that AI will further accelerate the volume of open source compromises. The rise of “vibe coding”—where developers use AI coding agents to rapidly generate and integrate code—creates new opportunities for manipulation. There have already been documented cases where AI agents unwittingly incorporated malicious packages into legitimate projects. For example, North Korean threat actors have uploaded cryptocurrency-themed malicious packages that were subsequently co-authored into projects by AI-driven development tools.

Mandatory Mitigation and Hardening Strategies

To counter these threats, organizations must move beyond treating security as a checklist and adopt a Zero Trust framework for their development lifecycle.

Administrative and Governance Controls

• Software Bill of Materials (SBOM): Maintain an automated, tiered inventory of all third-party dependencies. This allows the SOC to cross-reference active code inventories against newly disclosed IoC data and CVE reports.
• Cooldown Controls: For Node.js (npm/pnpm) environments, enforce a minimumReleaseAge configuration of at least 24 hours. This ensures that freshly published, potentially poisoned packages are quarantined until the security community can verify their integrity.
• Registry Pinning: Ensure Python (pip) environments do not pull directly from public PyPI registries. Use a vetted private --index-url to enforce consistent vetting and quarantine policies.

Architecture and Identity Engineering

• Hardware-Backed Identity: Transition away from static Personal Access Tokens (PATs) and mandate FIDO2 security keys for all command-line repository actions. This neutralizes the risk of credential theft through developer workstation compromise.
• Ephemeral CI/CD Runners: Utilize build runners that are purged immediately after a single task. This prevents attackers from maintaining persistence between different build phases or Lateral Movement within the pipeline.
• Lifecycle Script Sandboxing: Defenders should prioritize npm supply chain security best practices by setting ignore-scripts=true in .npmrc files. This prevents the automatic execution of malicious post-installation scripts, a common tactic used to exfiltrate environment variables and secrets during routine dependency updates.

By integrating these controls with native platform security features—such as Dependabot’s new version cooldowns and PyPI’s server-side immutability—organizations can build a resilient defense against the escalating threat of open source compromise.

Related: The EOL Blind Spot: Addressing CVE Gaps in Legacy Software, GitHub Actions Runners Weaponized to Attack cPanel and WHM Servers