StepSecurity Report Tracks 56 Open-Source Supply-Chain Attacks in 12 Months
Summary
StepSecurity says it tracked 56 confirmed malicious supply-chain compromises across trusted packages, GitHub Actions and IDE extensions in 12 months, with incidents rising sharply from March 2026. Its report highlights self-propagating worms and CI/CD credential theft.
Key points
- StepSecurity reports tracking 56 malicious supply-chain compromises over 12 months, excluding vulnerable packages, unconfirmed events and malicious packages that were harmful from their first version.
- The company counted 6 incidents from August 2025 through January 2026 and 50 from February through August 2026; it reports 13 incidents in March.
- The report describes self-propagating campaigns including Shai-Hulud, CanisterWorm, Miasma and ChainDrop, which spread through trusted packages, repositories or developer credentials.
- StepSecurity says a five-day Team PCP campaign in March 2026 stole 78,330 secrets from 2,186 organizations, including 92 public companies.
- The tracked incidents span package ecosystems and CI/CD platforms; examples include poisoned GitHub Action tags and malicious packages that targeted credentials in build runners.
- The report argues that production-focused software composition analysis may miss malicious code that has already run on developer machines or CI runners, and describes controls for blocking outbound exfiltration.
Article Details
- Publisher
- StepSecurity
- Report Period
- 2025-08 to 2026-08
- Scope
- Confirmed malicious compromises of trusted software supply-chain components tracked and alerted by StepSecurity.
- Sample Size
- 56 distinct supply chain attacks
- Key Statistics
- StepSecurity tracked and alerted on 56 confirmed supply chain attacks over 12 months.
- The first six months of the period (August 2025–January 2026) had 6 incidents; the following six and a half months had 50.
- March 2026 had 13 incidents; April had 9, May 9, June 10, and July 6.
- The five-day Team PCP campaign reportedly stole 78,330 secrets from 2,186 organizations, including 92 public companies with a combined value of $6.2 trillion.
- The September 2025 Shai-Hulud worm compromised more than 500 npm packages, according to the report.
- Recommendations
- Apply an egress policy to CI/CD runners to block outbound connections used to exfiltrate stolen credentials.
- Use workflow run policies that block workflows when secret exfiltration patterns are observed.
- Use Secure Registry to block compromised and typosquatted packages before they reach developer machines or CI runners.
- Search for exposure across developer machines, code repositories, open pull requests, and CI/CD pipelines.
MITRE ATT&CK
Threat Actors
hackerbot-clawThe report describes hackerbot-claw as an AI-powered bot that actively exploited GitHub Actions workflow vulnerabilities at Microsoft, Datadog, and CNCF projects.TeamPCPThe report says Team PCP ran a five-day campaign in March 2026, compromising trusted components and using stolen CI/CD credentials to enable further compromises.
Malware
CanisterWormCanisterWorm spread backdoors across npm in March 2026.ChainDropChainDrop arrived in August 2026 as a Bun loaded npm worm that harvests CI/CD credentials and uses an Ethereum smart contract as a dead drop for its command and control address.MiasmaThe Miasma worm forced Microsoft to disable the Azure Functions Action and 72 other repositories in June 2026, and resurfaced in July inside the AsyncAPI ecosystem.Shai-HuludIn September 2025, the Shai-Hulud worm compromised more than 500 npm packages by using each victim's stolen npm token to infect the packages they maintained.Shai-Hulud 2Sha1-Hulud, the second coming hit Zapier, ENS Domains, and other prominent npm packages in November 2025, and was later detected inside CNCF's Backstage repository.
Vendors
Products
AxiosThe same month brought a broader wave of credential stealing compromises, including axios, a package with over 100 million weekly downloads.Checkmarx KICS ActionThe components they poisoned included the Trivy GitHub Action (76 of its 77 version tags), the Checkmarx KICS Action, the telnyx PyPI package (with the stealer hidden in a WAV audio file), and LiteLLM, one of the mostDev Machine GuardInteractive demo: how Dev Machine Guard and Secure Registry protect developer machines and keep malicious packages out.GitHub ActionsStepSecurity's AI Package Analyst flagged the release, and Harden-Runner captured the live C2 callback during a GitHub Actions run in CNCF's Backstage repository, evidence the malware tried to delete.Harden-RunnerStepSecurity's AI Package Analyst flagged the release, and Harden-Runner captured the live C2 callback during a GitHub Actions run in CNCF's Backstage repository, evidence the malware tried to delete.LiteLLMthe Checkmarx KICS Action, the telnyx PyPI package (with the stealer hidden in a WAV audio file), and LiteLLM, one of the most widely used AI infrastructure packages.Secure RegistryInteractive demo: how Dev Machine Guard and Secure Registry protect developer machines and keep malicious packages out.Threat CenterFor every incident in this report, a Threat Center alert went out to StepSecurity customers.Trivy GitHub ActionThe components they poisoned included the Trivy GitHub Action (76 of its 77 version tags), the Checkmarx KICS Action, the telnyx PyPI package (with the stealer hidden in a WAV audio file), and LiteLLM, one of the most