Open source packages move to the center of supply chain risk
Google Threat Intelligence Group and Mandiant say large-scale open source software supply chain compromise expanded sharply across 2025 and early 2026. The report points to package repositories, developer tools and CI/CD workflows as the main pressure points. For crypto and web3 teams, the finding is not abstract: GTIG links one traditional supply chain case to an estimated $1.4 billion cryptocurrency theft.GTIG says package ecosystems carried the widest impact
The most far-reaching supply chain incidents tracked by GTIG in 2025 and early 2026 largely involved code repositories, software dependencies and developer tools. GTIG assesses with high confidence that very large open source campaigns, including worm-like and iterative compromises, expanded the use of this tactic compared with earlier years.The operational logic is direct. Open source package compromise can give attackers scale, stealth at the first stage and access to downstream environments without the planning burden of a classic vendor update compromise. GTIG also notes a counterweight: once activated, malicious packages are often noisy and can be discovered publicly faster than traditional supply chain intrusions. The implication for engineering teams is that detection speed matters, but prevention at install and build time matters more.
UNC6780 shows how developer workflows become credential targets
GTIG describes UNC6780, also known as TeamPCP, as conducting extensive open source supply chain compromises from February to May 2026 against ecosystems including PyPI, npm and Docker Hub. The initial infection vectors varied, but GTIG specifically cites abuse of the privileged GitHub Actions pull_request_target trigger to obtain repository secrets and write permissions.The actor typically used compromised packages to deploy credential stealers, including SANDCLOCK, and GTIG says it observed attempts to pivot from compromised artificial intelligence software into broader network environments. The report says UNC6780 monetized stolen credentials through direct sale or partnerships with ransomware and data theft extortion groups. For defenders, this frames package compromise less as a library hygiene issue and more as an identity, pipeline and secrets-management problem.
Axios compromise illustrates dependency blast radius
In March 2026, GTIG observed a malicious dependency introduced into the legitimate axios package. According to GTIG analysis and the maintainer's post mortem, a maintainer account was compromised through social engineering and used to publish updated versions.GTIG identified the malicious dependency as a dropper for the WAVESHAPER.V2 backdoor and attributed the activity to the North Korean actor MIDNIGHT NEPTUNE, formerly UNC1069. The malicious axios versions were removed from npm within three hours, but GTIG says the scope was estimated to be broad because axios has more than 100 million weekly downloads. GTIG supported customers in at least 15 industry verticals and 13 countries affected by the incident, and noted that axios is itself a dependency for tens of thousands of other packages.
AI coding expands the attack surface for malicious packages
GTIG expects AI adoption to accelerate open source supply chain compromise. The report links the risk to AI-assisted development practices, including so-called vibe coding, and to attackers using AI to scale planning or manipulate AI-related software components.The report says open sources have documented malicious resources planted in open source AI communities and malicious code inserted into Model Context Protocol packages, a protocol used by AI systems to interact with tools and data. It also says malicious packages have tricked AI coding agents into incorporating them into projects. In one reported case, North Korean actors uploaded malicious cryptocurrency-themed packages, and an AI coding agent later co-authored a commit integrating one malicious package as a dependency in a legitimate cryptocurrency trading project. Crypto developers relying on automated assistants therefore need dependency review controls that do not assume the agent understands trust boundaries.
Traditional supply chain compromise remains rarer but severe
GTIG contrasts the open source trend with traditional software supply chain compromise, meaning manipulation of source code or update and distribution mechanisms. It assesses with high confidence that traditional compromise remained rare in 2025 and early 2026, with the identified cases mainly tied to cyber espionage and limited targeting.The largest crypto-relevant example in the report involved North Korean actor UNC4899, which reportedly used social engineering to compromise a developer's machine at a web3 organization. GTIG says the actor used that access to inject malicious code into frontend systems affecting smart contract functionality, altering transactions initiated by a third party using a multi-signature wallet with the targeted organization. The compromise was tailored to one victim and did not directly touch the targeted organization's infrastructure, but it ultimately led to cryptocurrency theft estimated at $1.4 billion.
Mitigations focus on inventory, quarantine and identity limits
GTIG and Mandiant recommend a multi-tiered defense that begins with knowing what software and pipeline tools are in use. Their guidance includes continuous inventories of applications, vendors and services, automated Software Bills of Materials for internal and third-party packages, and an Action Bill of Materials to track third-party pipeline vendors and development utilities.For package management, the report recommends cooldown and quarantine controls. For Node.js environments using npm or pnpm, it says minimumReleaseAge should be set to at least 24 hours, or 1,440 minutes, so newly published packages are not installed immediately. For Python, it says projects should avoid pulling dependencies directly from public PyPI and should use a vetted private index URL. It also recommends hosting binaries, packages and container images in monitored internal repositories.
Identity controls are treated as a core defense. The guidance advises moving automated integrations away from static long-lived personal access tokens toward GitHub Apps or short-lived system tokens through OpenID Connect, limiting personal token and API key lifetimes, and using ephemeral CI/CD runners that are purged after one task. It also calls for strict governance of pull_request_target workflows, disabling automatic package install scripts where possible, and monitoring egress, logs and endpoint activity for signs of credential theft or command-and-control behavior.
Conclusion
The report's clearest warning is that open source supply chain compromise has become a scalable route into developer environments, not merely a rare downstream dependency incident. Fast package removal can limit damage, as the axios case shows, but broad dependency graphs and automated build systems can spread exposure before teams understand what changed.For crypto, AI and web3 organizations, the practical lesson is to treat package installation, CI/CD permissions and developer credentials as one connected risk surface. SBOMs, quarantine gates, short-lived credentials, isolated runners and tested incident playbooks are not separate checklist items. They are the controls most directly mapped to the attack paths GTIG describes.
Sources
Editorial Team - CoinBotLab
