Google and Mandiant Urge Stronger Defenses as Open-Source Supply-Chain Attacks Grow
Summary
Google Threat Intelligence Group and Mandiant report a sharp rise in large open-source supply-chain campaigns in 2025 and early 2026, and recommend controls to reduce dependency, developer-credential, and CI/CD risks.
Key points
- GTIG says large-scale open-source supply-chain campaigns, including worm-driven and iterative compromises, expanded in 2025 and early 2026.
- UNC6780 targeted ecosystems including PyPI, npm, and Docker Hub, using compromised packages to deploy credential stealers and seeking to monetize stolen credentials.
- A malicious dependency added to axios in March 2026 deployed the WAVESHAPER.V2 backdoor; the affected releases were removed from npm within three hours.
- OpenSSF figures cited by GTIG show malicious open-source packages identified rose 1,444% from 2024 to 2025.
- Recommended controls include dependency inventories and quarantine periods, private vetted package registries, short-lived credentials, and isolated, ephemeral CI/CD runners.
- The guidance also recommends restricting privileged workflow triggers, disabling package install scripts by default, and monitoring for suspicious code, pipeline, network, and credential activity.
Article Details
- Defense Focus
- Reduce exposure to software supply-chain compromises and detect malicious changes across dependencies, repositories, CI/CD pipelines, developer environments, and software distribution channels.
- Detection Methods
- Maintain automated SBOMs and cross-reference software inventories against newly disclosed vulnerabilities; maintain ABOMs to track third-party pipeline vendors and development utilities.
- Use OSV-Scanner in CI/CD pipelines to identify known vulnerabilities in dependencies.
- Audit dependency trees and maintainer email domains for DNS resolution and registration status.
- Validate update signatures and hashes against vendor-provided specifications before installation.
- Baseline network traffic and investigate suspicious egress to external repositories or unrecognized IP addresses.
- Use EDR on infrastructure and developer workstations to identify malicious post-execution activity.
- Alert on unauthorized code or build-parameter changes, anomalous workflow modifications or triggers, shell escapes or command substitution in untrusted inputs, and use of long-lived keys from unrecognized IP addresses or regions.
- Monitor public certificate-transparency ledgers and logs for unauthorized code-signing certificate activity; record firmware modifications and their sources.
- Data Sources
- SBOMs, ABOMs, dependency trees, and vulnerability disclosures
- DNS resolution and registration data for package maintainer email domains
- Repository, build-system, and CI/CD workflow logs
- Network egress and proxy traffic
- EDR telemetry from infrastructure and developer workstations
- Authentication events, source IP addresses, and regions
- Certificate-transparency ledgers and logs
- Firmware installation and source records
- Platforms
- CI/CD build pipelines
- Internal package repositories
- Developer workstations and build runners
- Endpoint detection and response platforms
- Central vulnerability-management platforms
- Defensive Actions
- Keep tiered inventories of applications, dependencies, vendors, services, and pipeline components, and assign owners and remediation dates to tracked risks.
- Apply package-release cooling periods and quarantine newly published packages; route Python dependencies through a vetted private index rather than directly through the public registry.
- Disable package lifecycle scripts by default and allow execution only for verified, essential dependencies.
- Use ephemeral, single-use CI/CD runners and isolate pipelines, test environments, and scripting sandboxes from production assets; restrict runner network egress.
- Secure privileged workflow triggers such as pull_request_target and alert on workflow changes that bypass code review.
- Replace long-lived administrative tokens with short-lived federated credentials, enforce token expiration, and use hardware-backed authentication for repository access.
- Enforce least privilege, multifactor authentication, network segmentation, and allow-list-only outbound firewall rules.
- Require monitored internal repositories for binaries, packages, and container images, and verify cryptographic integrity before installing updates.
- Conduct vendor security reviews, maintain supply-chain incident playbooks, and practice response to package takeovers, dependency confusion, pipeline credential harvesting, and developer-environment compromise.
MITRE ATT&CK
T1195.001 · Compromise Software Dependencies and Development ToolsThe article identifies compromise of code repositories, software dependencies, and developer tools as the prevalent supply-chain compromise vector in incidents tracked in 2025 and early 2026.T1195.002 · Compromise Software Supply ChainThe article describes traditional supply-chain compromise through manipulation of source code or software update and distribution mechanisms.
People
Threat Actors
APT29Identified in the article as the former name of ICE RELIC.ICE RELICDescribed as a Russian cyber espionage actor; the article says it was formerly known as APT29.MIDNIGHT NEPTUNEAttributed the malicious axios dependency activity in March 2026 to this North Korean actor; the article says it was formerly known as UNC1069.TeamPCPIdentified in the article as an alias of UNC6780.UNC1069Identified in the article as the former name of MIDNIGHT NEPTUNE.UNC4736Described as a North Korean cyber espionage actor responsible for the 2023 compromise of 3CX.UNC4899Reportedly compromised a developer's machine at a web3 organization and used access to inject code affecting smart-contract transactions.UNC6688Attributed by GTIG to the compromise of hosting infrastructure serving Notepad++ updates from June to December 2025.UNC6780Conducted extensive open-source supply-chain compromises from February to May 2026; the article identifies TeamPCP as an alias.UNC6863Deployed SLICKDEMON during the early-2026 DAEMON Tools installer campaign, according to the article.
Malware
BADFALLFollowing this profiling stage, the group selectively delivered the shellcoded loader BADFALL to facilitate hands-on-keyboard activity and bridge the deployment of the advanced QUIC RAT.QUIC RATFollowing this profiling stage, the group selectively delivered the shellcoded loader BADFALL to facilitate hands-on-keyboard activity and bridge the deployment of the advanced QUIC RAT.SANDCLOCKThe threat actor typically used compromised packages to deploy credential stealers, including SANDCLOCK, to obtain high value secrets.SectopRATautomotive dealership websites served ClickFix lures leading to the installation of SHADOWLADDER (aka SectopRAT), and in another, eCommerce websites were infected with web skimmers.SLICKDEMONDuring this campaign, UNC6863 deployed SLICKDEMON to perform broad-spectrum reconnaissance and filter for targets of strategic interest.WAVESHAPER.V2We identified the malicious dependency as a dropper that deploys the WAVESHAPER.V2 backdoor, and attributes the activity to North Korean actor MIDNIGHT NEPTUNE (formerly known as UNC1069).
Vendors
GitHubInitial infection vectors varied across incidents, and included abuse of the pull_request_target GitHub Actions trigger to obtain base repository secrets and write permissions.GoogleHowever, Google Threat Intelligence Group (GTIG) has been tracking growth in threat activity targeting open source software repositories to conduct supply chain compromises over the past several years.MandiantIn this blog post, GTIG and Mandiant discuss trends we have observed in threat actor use of software supply chain compromise, and provide mitigation and hardening recommendations that incorporate insights we haveWizSoftware Development Lifecycle (SDLC) Threat Modeling and Attack Chain Mapping (Wiz SITF): Align your software supply chain risk management with capabilities such as the Wiz SDLC Infrastructure Threat Framework (SITF)
Products
3CXAPT29) 2020 compromise of SolarWinds and North Korean cyber espionage actor UNC4736's 2023 compromise of 3CX.AxiosIn March 2026, GTIG observed the introduction of a malicious dependency in the legitimate axios package.DAEMON ToolsGTIG also tracked the early 2026 compromise of DAEMON Tools installers.DependabotDependabot Native Cooldowns (July 2026): Dependabot now enforces a default three-day cooldown on version updates to allow for the public discovery of upstream compromises (such as the historical chalk and debugDocker HubFor example from February to May 2026, UNC6780 (aka "TeamPCP") conducted extensive open source supply chain compromises targeting ecosystems like PyPI, npm, and Docker Hub.GitHub ActionsInitial infection vectors varied across incidents, and included abuse of the pull_request_target GitHub Actions trigger to obtain base repository secrets and write permissions.GitHub Enterprise Cloudtheft, organizations should consider restricting Personal Access Tokens (PATs) globally across GitHub Enterprise Cloud.Google Assured Open Source SoftwareNotepad++Other examples include the compromise of hosting infrastructure serving updates of Notepad++ from June to December 2025, activity GTIG attributes to UNC6688.npmFor example from February to May 2026, UNC6780 (aka "TeamPCP") conducted extensive open source supply chain compromises targeting ecosystems like PyPI, npm, and Docker Hub.OSV.devThis tool provides an officially supported frontend to the OSV.dev database that maps a project's list of dependencies with the specific vulnerabilities affecting them.PyPIFor example from February to May 2026, UNC6780 (aka "TeamPCP") conducted extensive open source supply chain compromises targeting ecosystems like PyPI, npm, and Docker Hub.SolarWindsincluding Russian cyber espionage actor ICE RELIC’s (formerly known as APT29) 2020 compromise of SolarWinds and North Korean cyber espionage actor UNC4736's 2023 compromise of 3CX.
Tools
Countries
BelarusThe campaign targeted Russia, Brazil, and Turkey, with follow-on exploitation of government and scientific entities in Belarus and Thailand.BrazilThe campaign targeted Russia, Brazil, and Turkey, with follow-on exploitation of government and scientific entities in Belarus and Thailand.FranceGTIG observed organizations in South Korea and France affected by this activity.North KoreaRussiaThe campaign targeted Russia, Brazil, and Turkey, with follow-on exploitation of government and scientific entities in Belarus and Thailand.South KoreaGTIG observed organizations in South Korea and France affected by this activity.ThailandThe campaign targeted Russia, Brazil, and Turkey, with follow-on exploitation of government and scientific entities in Belarus and Thailand.TurkeyThe campaign targeted Russia, Brazil, and Turkey, with follow-on exploitation of government and scientific entities in Belarus and Thailand.
Industries
Automotiveincidents threat actors compromised underlying software used in consumer-facing websites: in one case, automotive dealership websites served ClickFix lures leading to the installation of SHADOWLADDER (aka SectopRAT),CryptocurrencyNorth Korean threat actors reportedly uploaded malicious cryptocurrency-themed packages, and subsequently an AI coding agent co-authored a commit integrating one of the malicious packages as a dependency to a legitimateE-commerceserved ClickFix lures leading to the installation of SHADOWLADDER (aka SectopRAT), and in another, eCommerce websites were infected with web skimmers.GovernmentThe campaign targeted Russia, Brazil, and Turkey, with follow-on exploitation of government and scientific entities in Belarus and Thailand.ScientificThe campaign targeted Russia, Brazil, and Turkey, with follow-on exploitation of government and scientific entities in Belarus and Thailand.SoftwareFor years, the cybersecurity industry's understanding of software supply chain compromise has been anchored by a few watershed events, including Russian cyber espionage actor ICE RELIC’s (formerly known as APT29) 2020