Supply-Chain Malware Campaigns Target Developers and CI Systems in 2026
Summary
OpenSourceMalware analyzes January–May 2026 campaigns targeting developers, software packages, and CI systems, detailing malware delivery, credential theft, propagation, and attribution limits.
Key points
- Lazarus Group campaigns used malicious VS Code task files to execute BeaverTail, harvest credentials, and support follow-on malicious pull requests through the TasksJacker and PolinRider operation.
- TeamPCP exploited a retained Aqua Security service-account token to tamper with Trivy GitHub Actions, steal publishing credentials, and compromise packages and CI workflows.
- CanisterWorm stole npm publishing tokens and republished packages; the campaign reached 141 artifacts across more than 66 packages and used an ICP Canister for dynamic payload delivery.
- Mini Shai-Hulud compromised npm publisher accounts and spread through GitHub repositories using VS Code tasks and a Claude Code hook. The article links activity involving TanStack to exposure of 5,000 private repositories.
- The review attributes 10.5% of malicious packages to Lazarus Group or TeamPCP and leaves 89.5% unattributed.
- Glassworm used blockchain, BitTorrent, Google Calendar, and direct-server command-and-control channels; CrowdStrike, Google, and Shadowserver took down the reported channels on May 26.
- Other campaigns included an axios maintainer-account compromise that added a malicious transitive dependency, and Stardrop packages that impersonated an AI coding agent while harvesting API keys.
Article Details
- Attack Vectors
- Lazarus Group's Contagious Interview campaign used fake recruiting outreach to direct software engineers to malicious GitHub repositories; the repositories used malicious npm dependencies, malicious web apps, or .vscode/tasks.json files to execute BeaverTail.
- TasksJacker injected malicious .vscode/tasks.json files into repositories. Cloning and opening a compromised repository in VS Code triggered execution without further interaction. Related payloads were hidden in a WOFF2 file containing hex-encoded JavaScript or in a spellright.dict file containing obfuscated JavaScript.
- PolinRider used stolen credentials to fork popular open-source projects and submit malicious pull requests that injected payloads into JavaScript configuration files executed during builds.
- TeamPCP used a retained Aqua Security service-account PAT to force-push malicious commits to Trivy GitHub Actions tags, compromising CI runners and harvesting publishing tokens. The stolen tokens enabled malicious package releases and compromised GitHub Actions, Docker Hub images, and OpenVSX extensions.
- TeamPCP's Bitwarden CLI package compromise replaced the preinstall hook and binary entrypoint with a loader that downloaded Bun from GitHub and executed a credential-stealing payload.
- CanisterWorm used a malicious npm postinstall hook to steal npm publishing tokens, enumerate publishable packages, and republish them with the worm. It polled an ICP Canister node for dynamic payloads.
- Mini Shai-Hulud compromised npm publisher accounts with stolen tokens, then spread through accessible GitHub repositories by writing .vscode/tasks.json files with folderOpen triggers and Claude Code SessionStart hooks.
- Glassworm used force-push git history rewriting and C2 channels including Solana, BitTorrent DHT, Google Calendar, and direct servers.
- The axios compromise added the malicious transitive dependency plain-crypto-js, which deployed obfuscated, multi-stage remote access trojans.
- Stardrop packages used optional platform-specific dependencies with precompiled binaries and fake onboarding prompts to solicit API keys while harvesting credentials.
- Moika packages used dependency confusion and postinstall hooks to exfiltrate environment variables.
- Defensive Notes
- Review repository task configuration and unfamiliar files such as .vscode/tasks.json, spellright.dict, and font assets for hidden or obfuscated executable code.
- Audit build-time JavaScript configuration, package lifecycle hooks, transitive dependencies, and package publisher activity, not only direct dependencies.
- Rotate and revoke retained service-account and publishing credentials; investigate CI runners and registry accounts exposed during the compromise window.
- Inspect VS Code extensions, OpenVSX extensions, GitHub Actions, Docker images, and published packages for unauthorized changes.
- The article reports that Google, Crowdstrike, and the Shadowserver Foundation took down Glassworm's four C2 channels on May 26, 2026.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | oob[.]moika[.]tech | C2 domain shared by threats in the Moika campaign. |
| DOMAIN | sfrclak[.]com | C2 domain reported for the malware deployed through the axios compromise. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe malicious Dictionary sub-campaign used obfuscated JavaScript, and the article also describes heavily obfuscated malware payloads.T1036 · MasqueradingThe Fake Font sub-campaign concealed hex-encoded JavaScript in a WOFF2 file made to look like a normal web asset.T1053.005 · Scheduled TaskMalicious .vscode/tasks.json configurations used automatic folder-open execution in compromised repositories.T1059.001 · PowerShellThe article describes obfuscated JavaScript payloads executed by malicious repository files and package hooks.T1059.003 · Windows Command ShellPolinRider's temp_auto_push.bat script was used in the campaigns.T1059.006 · PythonThe article describes Python .pth code executing at interpreter startup in the malicious LiteLLM release.T1059.007 · JavaScriptTasksJacker's fake-font payload decoded and executed JavaScript with Node.T1102 · Web ServiceGlassworm used Google Calendar as one of its reported C2 channels.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious package releases and compromised software repositories were used to distribute payloads through software dependencies and development tools.T1195.002 · Compromise Software Supply ChainAttackers compromised CI/CD workflows, including Trivy GitHub Actions repositories and Checkmarx actions, to deliver credential-stealing payloads.T1528 · Steal Application Access TokenStolen npm publishing tokens were used to publish malicious packages and propagate CanisterWorm.T1552.004 · Private KeysThe attacks harvested credentials and secrets from CI runners and developer environments, including npm tokens, SSH keys, and cloud credentials.T1555.003 · Credentials from Web BrowsersBeaverTail and InvisibleFerret were described as stealing browser credentials.T1567 · Exfiltration Over Web ServiceMoika postinstall hooks exfiltrated full environment variables; other payloads exfiltrated stolen credentials.
Threat Actors
Malware
BeaverTailauto-installing malware much in the same way as an npm lifecycle script. Both tactics silently execute BeaverTail, a multi-stage loader that deploys InvisibleFerret, a Python backdoor capable of stealingCanisterSprawl@emilgroup scope in under 60 seconds; the full campaign reached 141 artifacts across 66+ packages. CanisterSprawl — an evolution of the CanisterWorm malware — hit npm, PyPI, and Docker Hub between April 21-23. SeeCanisterWormevery CI runner that executed the action. npm publish tokens harvested from those runners fueled the CanisterWorm deployment across 66+ packages (more on CanisterWorm below). BerriAI’s CI pipeline for LiteLLM ranChainDropMini Shai-Hulud CampaignGlassWormGlassworm CampaignInvisibleFerretan npm lifecycle script. Both tactics silently execute BeaverTail, a multi-stage loader that deploys InvisibleFerret, a Python backdoor capable of stealing cryptocurrency wallets, browser credentials, and SSH keys.plain-crypto-jsRather than modifying the package code, the attacker injected a malicious transitive dependency, plain-crypto-js. This technique bypasses direct dependency auditing entirely. The malware deployed cross-platform
Vendors
Aqua Securitysupply chain attack seeded by a single unrevoked credential retained from an incomplete rotation at Aqua Security. Using the aqua-bot service account’s PAT, they force-pushed malicious commits to 76 version tagsCheckmarxmalicious Telnyx versions appeared on PyPI hiding the final payload inside WAV audio files. A parallel Checkmarx phase deployed nearly identical credential stealers into checkmarx/ast-github-action andCrowdStrikesimultaneously: the Solana blockchain, BitTorrent DHT, Google Calendar, and direct servers. On May 26, Crowdstrike (with help from Google and the Shadowserver Foundation) did a take down of all four channels. That willGoogleIts C2 infrastructure spanned four channels simultaneously: the Solana blockchain, BitTorrent DHT, Google Calendar, and direct servers. On May 26, Crowdstrike (with help from Google and the ShadowserverShadowserver FoundationDHT, Google Calendar, and direct servers. On May 26, Crowdstrike (with help from Google and the Shadowserver Foundation) did a take down of all four channels. That will slow down Glassworm but it’s probably not the
Products
AxiosAxios CompromiseBitwarden CLICheckmarx credentials then became the pivot point for the campaign’s highest-profile victim: the Bitwarden CLI. Version 2026.4.0 of @bitwarden/cli appeared on npm on April 22 and remained available forLiteLLMthe CanisterWorm deployment across 66+ packages (more on CanisterWorm below). BerriAI’s CI pipeline for LiteLLM ran Trivy during the exposure window, handing TeamPCP the PyPI publishing token for the project’sNxall attributable to this campaign. Access to TanStack enabled TeamPCP to poison a VS Code extension for Nx that was consumed by a GitHub employee, resulting in 5000 private repos getting exposed. See theOpenVSXcredential stealers into checkmarx/ast-github-action and checkmarx/kics-github-action, with malicious OpenVSX extensions published through a compromised Checkmarx account.TanStacksharply the week of May 11 with 172 additional packages compromised, including the hugely popular TanStack package. The folderOpen persistence primitive is a direct lift from PolinRider’s tradecraft, crossingTrivyUsing the aqua-bot service account’s PAT, they force-pushed malicious commits to 76 version tags across Trivy’s GitHub Actions repositories, distributing a credential-stealing payload to every CI runner that executedVS Codeused in Contagious Interview entirely. When a developer clones a compromised repository and opens it in VS Code, the tasks file executes automatically with no further interaction required. The campaign compromised
Tools
Bunmalware rewired both the preinstall hook and the bw binary entrypoint to a custom loader that downloaded a Bun runtime from GitHub and executed a credential-stealing payload, exfiltrating npm tokens, SSH keys, AWSClaude Code.vscode/tasks.json with a folderOpen trigger into up to 50 branches per repository, alongside a Claude Code SessionStart hook. The worm’s payload uses the Bun runtime downloaded from the official oven-sh release
Industries
Cryptocurrencyand espionage-driven campaigns. Their open source supply chain activity is primarily focused on cryptocurrency theft, which funds North Korean state programs including weapons development. Attribution isfinancialacross nine scoped namespaces impersonating internal tooling at a Russian cloud platform provider, a financial institution (Sberbank), and the EMCD cryptocurrency exchange. The packages used a dependency confusionSoftwareEarlier this month we published a blog (The Software Supply Chain Malware Landscape: January - May 2026) that covered trends in our data for the first half of the year. In this article, we drew from the same data set