Software Supply Chain Attacks: Deep Research 2024–2026

s1ngularity — Nx Build System Compromise (August 2025)

An attacker compromised the Nx monorepo build system by injecting a data-stealing payload into the @nx/devkit package. The attack abused CI/CD workflows to exfiltrate environment variables and secrets from developer machines and build servers.

• Target: Nx monorepo framework (used by thousands of enterprises)
• Technique: Malicious npm package injection via compromised CI/CD
• Impact: Credential theft from downstream build environments

Shai-Hulud Worm — 500+ npm Packages (September 2025)

The largest npm supply chain attack in history at the time. A self-replicating worm dubbed Shai-Hulud (named after the sandworm in Dune) compromised over 500 npm packages.

Key Traits:

• Self-propagation — Automatically infected additional packages using existing trust relationships
• Autonomy — Ran without direct operator input after initial deployment
• Environmental embedding — Targeted CI/CD environments for persistent access

CISA issued emergency alert AA-25-282A on September 23, 2025.

”Popular Packages” Attack — chalk, debug, strip-ansi (September 2025)

Simultaneously with Shai-Hulud, a separate campaign targeted high-profile npm maintainers:

• chalk — 30M+ weekly downloads
• debug — 25M+ weekly downloads
• strip-ansi, color-convert, wrap-ansi, and 14+ other packages

Total: 200+ packages with a combined 2.6 billion weekly downloads. Payload: Cryptohijacker — hijacked web APIs and manipulated network traffic to divert cryptocurrency to attacker-controlled wallets.

Shai-Hulud “Second Coming” (October 2025)

A second wave hit additional packages including Zapier and ENS Domains, proving the worm continued evolving despite takedowns.

tj-actions GitHub Action Compromise (CVE-2025-30066)

The widely-used tj-actions/changed-files GitHub Action was compromised, exposing secrets from numerous repositories that used it in their CI/CD pipelines. The OIDC memory-extraction technique used here was later reused in the TanStack attack.

Axios Compromise — North Korean RAT (March 31, 2026)

The most alarming attack to date. The axios npm package — with 100 million weekly downloads, present in ~80% of cloud environments — was hijacked by a North Korean nation-state actor.

What happened:

• Attacker compromised npm credentials of jasonsaayman, the lead maintainer
• Published two backdoored releases: axios@1.14.1 (latest) and axios@0.30.4 (legacy)
• Added a single malicious dependency: plain-crypto-js@4.2.1
• Staged the ground 18 hours earlier with a clean version (4.2.0) to avoid flags
• 3-hour exposure window before community detection and npm takedown

The Payload — WAVESHAPER.V2 RAT:

• Platform detection (macOS, Windows, Linux)
• C2 beacon to sfrclak.com:8000
• Second-stage binary delivery (platform-specific)
• Self-destruction — Deleted setup.js and replaced package.json with a clean version to evade forensic detection
• Full system access: reconnaissance, shell command execution, file enumeration, persistent 60-second beaconing

Google’s Threat Intelligence Group (GTIG) attributed the payload to UNC1069, a financially-motivated North Korean threat actor active since 2018. This was the first confirmed nation-state attack on one of npm’s top-10 packages. Wiz observed execution of the malicious payload in 3% of monitored environments.

Glassworm Campaign & Trivy Scanner Compromise (March 2026)

Alongside the Axios attack, March 2026 saw the Glassworm campaign targeting multiple developer tools, and a compromise of the Trivy container scanner — a security tool used by thousands of organizations to scan for vulnerabilities.

OpenAI Affected by Mini Shai-Hulud (May 2026)

OpenAI confirmed it was affected by the Mini Shai-Hulud supply chain attack, demonstrating that even the world’s leading AI companies are vulnerable.

Miasma — Red Hat @redhat-cloud-services Compromise (June 1, 2026)

32 package releases under the official Red Hat npm namespace were compromised with ~80,000 cumulative weekly downloads.

Root Cause: A Red Hat employee’s GitHub account was compromised. The attacker pushed malicious orphan commits to RedHatInsights repositories, bypassing code review. A GitHub Actions workflow requested an OIDC token for npm publishing and executed an obfuscated payload — with valid SLSA provenance attestations.

Payload (“Miasma”):

• Derived from the open-sourced Mini Shai-Hulud malware (TeamPCP)
• Greek mythology-themed variant (Dune references replaced with “spartan”)
• New: Cloud identity collectors for GCP and Azure (beyond just secrets — full cloud access)
• Unique per-infection encryption making hash-based IOCs useless
• Preinstall scripts triggered automatic execution during npm install

TanStack — Three-Vulnerability Cache-Poisoning Chain (May 11, 2026)

The most technically sophisticated npm supply chain attack to date. A single attacker chained three separate vulnerabilities to publish 84 malicious versions across 42 @tanstack/ packages* in a 6-minute window, subsequently affecting TanStack, Mistral AI, UiPath, OpenAI, and 160+ additional npm and PyPI packages (404 malicious versions total).

1
The Attack Chain (Three Vulnerabilities Chained)
2
════════════════════════════════════════════
3

4
1. pull_request_target "Pwn Request" pattern
5
   → bundle-size.yml auto-ran on fork PRs, checking out fork code in base-repo context
6
   → No first-time-contributor approval required for pull_request_target
7

8
2. GitHub Actions cache poisoning across trust boundaries
9
   → Malicious vite_setup.mjs (~30,000 lines) wrote poisoned pnpm store
10
   → Cache key matched what release.yml would restore on push to main
11
   → actions/cache@v5 saves use runner-internal token, not GITHUB_TOKEN
12

13
3. OIDC runtime memory extraction
14
   → Poisoned binaries located GitHub Actions Runner.Worker process via /proc
15
   → Read /proc/<pid>/maps and /proc/<pid>/mem to dump worker memory
16
   → Extracted OIDC token (minted lazily when id-token: write is set)
17
   → POSTed directly to registry.npmjs.org — bypassing the workflow's Publish step

Detection: External researcher ashishkurmi (StepSecurity) detected the compromise within 20 minutes of publish. All versions deprecated within 1h 43m, npm tarballs pulled within 4h 35m.

What the malware does:

• Harvests credentials: AWS IMDS/Secrets Manager, GCP metadata, Kubernetes tokens, Vault tokens, ~/.npmrc, GitHub tokens, SSH private keys
• Self-propagates: enumerates other packages the victim maintains via npm search API and republishes them with the same injection
• Exfiltrates over Session/Oxen messenger file-upload network (end-to-end encrypted, blocking by IP/domain is the only mitigation)

Downstream victims: Grafana Labs confirmed their GitHub environment was breached via the TanStack attack — a missed workflow token gave attackers access to download source code. OpenAI confirmed it was also affected.

Atomic Arch — 400+ Arch Linux AUR Packages Hijacked (June 11, 2026)

The attack shifted from npm to Linux package repositories. Sonatype researchers dubbed this campaign “Atomic Arch” after discovering attackers had systematically adopted orphaned Arch User Repository (AUR) packages and injected malicious build logic.

The attack pattern — trust hijacking, not typosquatting:

1. Adopt orphaned packages — targeted packages with existing users and legitimate history
2. Inject malicious dependency — modified PKGBUILD or install hooks to run npm install atomic-lockfile (or bun install js-digest in wave 2)
3. Silent execution — when users built the AUR package, it transparently fetched and executed the malicious dependency

Attackers spoofed git commit metadata to make changes look like they came from a long-standing maintainer. The Arch Linux Trusted User confirmed the account was never compromised — the attacker fabricated the identity.

The payload — Rust credential stealer with optional eBPF rootkit:

• Browser cookies and session tokens (Chrome, Edge, Brave, Chromium-based)
• Electron app sessions (Slack, Discord, Microsoft Teams)
• GitHub, npm, HashiCorp Vault tokens, OpenAI/ChatGPT bearer material
• SSH keys, known_hosts, shell histories
• Docker and Podman credentials, VPN profiles
• eBPF rootkit (optional, only when running as root with capabilities): hides malware processes, names, and socket inodes from standard tools
• Staged possible Monero cryptominer alongside rootkit
• Persistence via systemd service with Restart=always
• Exfiltration over HTTP to temp.sh, C2 via Tor onion service

Why this matters beyond Arch: The same ownership-transfer model exists in Homebrew (macOS), Chocolatey (Windows), and npm itself. A recently adopted package, or one that suddenly sprouts new install hooks, deserves the same suspicion as a package from a stranger.

North Korea (DPRK)

Tactics: Spear phishing (posing as recruiters/VCs), social engineering via LinkedIn, supply chain compromise, custom malware (WAVESHAPER), living-off-the-land. Unique characteristic: blurs line between espionage and cybercrime — hacking is a revenue stream for the regime.

Russia

Tactics: Sophisticated spear phishing, supply chain compromise, zero-day exploitation, credential harvesting, cloud token theft (Golden SAML). Unique characteristic: most technically sophisticated tradecraft — APT29’s low-noise, long-term espionage is the gold standard.

China

Tactics: Living-off-the-land exclusively (no malware), exploiting SOHO routers/firewalls as proxies, wide-net phishing, supply chain compromise via third-party IT providers. Unique characteristic: largest scale — Microsoft tracks 600+ nation-state groups.

Iran

Non-State Actors

AI as a Force Multiplier

• AI-generated phishing emails (1,265% surge in phishing)
• Deepfake voice calls and video for social engineering
• AI-accelerated vulnerability discovery
• Automated reconnaissance and malware adaptation
• Microsoft: Tracking 600+ distinct nation-state hacker groups worldwide

Supply Chain Kill Chain

Key Technical Innovations in 2025–2026

1. Valid SLSA Provenance Forgery — Miasma produced cryptographically valid provenance by abusing OIDC trusted publishing
2. Worm-like Self-Propagation — Shai-Hulud automated republication across npm using stolen credentials
3. Multi-stage Droppers — Clean dependency staged first, malicious version pushed hours later (Axios/plain-crypto-js)
4. Self-destructing Payloads — Automatic forensic cleanup after execution
5. Cloud Identity Harvesting — Beyond secrets → targeting cloud IAM permissions directly

SLSA (Supply-chain Levels for Software Artifacts)

The gold standard framework for build integrity, governed by OpenSSF.

SBOM, Regulations, and Frameworks

• SBOM (Software Bill of Materials) — Lists all components; complementary to SLSA (SBOM = ingredient list, SLSA = food safety cert). Required under EU Cyber Resilience Act and US EO 14028
• US EO 14028 — Requires attestation to secure development practices
• NIST SSDF — Secure Software Development Framework
• CISA Guidelines — Securing the Software Supply Chain for Developers
• EU CRA — Cyber Resilience Act (mandatory SBOM, vulnerability handling)
• OpenSSF Scorecard — Automated security assessment for open source projects

Technical Controls

1
✅ Pin all dependency versions (package-lock.json, go.sum)
2
✅ Use lockfiles — NEVER rely on version ranges for critical packages
3
✅ Pin to known-safe versions before incident dates
4
✅ Audit dependency trees for transitive risks
5
✅ Use allowlists for approved packages/registries
6
✅ Block dependency confusion (configure private registry priority)
7
✅ Generate and review SBOMs regularly

1
✅ Implement SLSA Level 2+ (signed provenance)
2
✅ Use ephemeral, isolated build environments
3
✅ Separate signing keys from build steps
4
✅ Require code review for ALL CI/CD changes
5
✅ Audit OIDC trusted publishing configurations
6
✅ Monitor workflow files for unauthorized modifications
7
✅ Implement branch protection rules on CI/CD repos

1
✅ Mandatory phishing-resistant MFA on ALL developer accounts
2
✅ Use hardware security keys (YubiKey) for critical accounts
3
✅ Principle of least privilege for all accounts
4
✅ Just-in-time privilege elevation (not standing admin access)
5
✅ Regular credential rotation
6
✅ Monitor for impossible travel / anomalous logins

1
✅ Monitor for anomalous network behavior (webhook.site, C2 traffic)
2
✅ Check for TruffleHog and similar scanning tools in use
3
✅ Monitor GitHub for unauthorized repos, tokens, workflow executions
4
✅ Enable GitHub Secret Scanning + Dependabot security updates
5
✅ Use EDR on developer workstations and build servers
6
✅ Aggregate logs in SIEM — query for known APT TTPs

1
✅ Verify npm package provenance before deployment
2
✅ Use Sigstore/Cosign for container image signing
3
✅ Verify artifact digests match expected values
4
✅ Validate source repository AND commit hashes
5
✅ Policy-as-code enforcement at deployment boundaries

Organizational Practices

Vendor Risk Management: Assess supplier security posture, require SLSA compliance, monitor upstream advisories, have incident response plans for supply chain compromises.

Zero Trust for Software: Never implicitly trust a package because of its name or popularity. Verify every dependency, every build, every deployment. The Axios attack proved that even the most trusted packages can be compromised.

Incident Response

1
1. ISOLATE     → Quarantine affected systems immediately
2
2. IDENTIFY    → Check installed versions (npm ls, audit lockfiles)
3
3. ROTATE      → Rotate ALL credentials (GitHub tokens, cloud keys, SSH keys)
4
4. DOWNGRADE   → Pin to known-safe versions
5
5. INVESTIGATE → Search for IOCs (DNS logs, network connections, process logs)
6
6. AUDIT       → Review CI/CD pipelines, build logs, artifact integrity
7
7. NOTIFY      → Report to CISA/FBI, inform downstream dependents