step-security Aug 23, 2026 · Crawled Sep 15, 2026

The State of Open Source Supply Chain Attacks

14 IoCs 1 Malware

AI Summary

Over a 12-month period from August 2025 to August 2026, 56 distinct open source supply chain attacks were observed, with a significant increase in frequency starting in March 2026. These attacks primarily involved malicious compromises of trusted packages across npm, PyPI, RubyGems, Composer, and crates.io, as well as GitHub Actions and IDE extensions, designed to steal CI/CD credentials. A key trend is the rise of self-propagating worms such as Shai-Hulud, CanisterWorm, Miasma, and ChainDrop, which leverage stolen tokens to infect downstream packages at scale. The Team PCP campaign in March 2026 exemplifies the severity, compromising widely used components like Trivy Action, KICS Action, telnyx, and LiteLLM to harvest credentials across major CI/CD platforms.

AI-extracted · verify before operational use

Extracted Entities 1 found

Malware Shai-Hulud →

Indicators of Compromise 14 extracted

Type	Value	Detail
Package	[email protected]	Details →
Package	[email protected]	Details →
Package	trivy	Details →
Package	checkmarx-kics	Details →
Package	telnyx	Details →
Package	liteml	Details →
Package	intercom-client	Details →
Package	durabletask	Details →
Package	git_credential_manager	Details →
Package	fastlane	Details →
Package	laravel-lang	Details →
Package	arrayref	Details →
Package	internment	Details →
Package	append-only-vec	Details →

MITRE ATT&CK TTPs 29 techniques

T1021 Remote Services · Lateral Movement T1021.003 Distributed Component Object Model · Lateral Movement T1055 Process Injection · Defense Evasion T1059.001 PowerShell · Execution T1059.007 JavaScript · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1071.003 Mail Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1078.004 Cloud Accounts · Defense Evasion T1081 T1081 T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1086 T1086 T1090 Proxy · Command And Control T1098 Account Manipulation · Persistence T1105 Ingress Tool Transfer · Command And Control T1133 External Remote Services · Persistence T1195 Supply Chain Compromise · Initial Access T1195.001 Compromise Software Dependencies and Development Tools · Initial Access T1195.002 Compromise Software Supply Chain · Initial Access T1485 Data Destruction · Impact T1528 Steal Application Access Token · Credential Access T1530 Data from Cloud Storage · Collection T1552 Unsecured Credentials · Credential Access T1553 Subvert Trust Controls · Defense Evasion T1555 Credentials from Password Stores · Credential Access T1566 Phishing · Initial Access