Batten Down Your Packages: Supply Chain Attack Surge

The swamp is getting crowded, and not with friendly capybaras. Google Threat Intelligence Group (GTIG) has tracked a massive surge in open-source supply chain compromises, with malicious packages skyrocketing 1,444% from 2024 to 2025. If you’re pulling dependencies from PyPI, npm, or Docker Hub without a second thought, it’s time to batten down the hatches.

The Rising Tide of Open-Source Attacks

In 2025 and early 2026, threat actors like UNC6780 (aka TeamPCP) ran extensive campaigns targeting ecosystems like PyPI, npm, and Docker Hub. They abused GitHub Actions triggers, deployed credential stealers like SANDCLOCK, and even pivoted from compromised AI software to broader networks. The infamous axios compromise in March 2026—where a maintainer account was socially engineered to push a malicious dependency—affected over 100 million weekly downloads and spread to tens of thousands of downstream packages.

GTIG warns that AI will accelerate this trend. Attackers are planting malicious code in open-source AI communities and tricking AI coding agents into incorporating compromised packages. North Korean actors have even used AI agents to co-author commits that introduce malicious dependencies.

Traditional Supply Chain Compromise: Still Rare, But Deadly

While open-source attacks are booming, traditional supply chain compromises (manipulating source code or update mechanisms) remain rare. Notable exceptions include the $1.4B Bybit hack, where a North Korean actor compromised a developer’s machine to inject malicious code into a multi-signature wallet’s frontend. Other cases involved compromised hosting infrastructure for Notepad++ and DAEMON Tools installers, targeting specific regions and sectors.

How to Fortify Your Digital Swamp

GTIG and Mandiant offer a multi-tiered defensive strategy. Here are the key takeaways for developers:

Administrative Oversight

• Catalog Assets and Dependencies: Maintain a tiered inventory of all apps, vendors, and services.
• SBOM & ABOM: Automate Software Bill of Materials and Action Bill of Materials to track dependencies and pipeline vendors.
• Threat Modeling: Use frameworks like Wiz SITF to map attack chains across your SDLC.

Secure Development Ecosystems

• Quarantine Gates: Enforce cooling windows on new packages. For npm/pnpm, set minimumReleaseAge to at least 24 hours. For pip, use a private --index-url.
• Disable Lifecycle Scripts: Set ignore-scripts=true in .npmrc and use pnpm’s onlyBuiltDependencies allowlist.
• Use Ephemeral Runners: Ensure CI/CD runners are single-use and isolated.

Identity & Access Management

• Short-Lived Tokens: Replace long-lived PATs with OIDC-based tokens that expire in minutes.
• FIDO2 SSH Keys: Mandate hardware-backed keys for Git operations.
• Restrict pull_request_target: This trigger has been exploited in multiple campaigns.

Continuous Verification

• Automated SBOM Management: Feed SBOMs into vulnerability management platforms.
• OSV-Scanner: Integrate Google’s open-source scanner for high-fidelity vulnerability detection.
• Log Aggregation: Monitor for unauthorized code changes, credential misuse, and anomalous CI/CD triggers.

Native Ecosystem Guardrails

Platforms are stepping up. Dependabot now enforces a three-day cooldown on version updates. PyPI rejects new file uploads to releases older than 14 days. npm v12 disables lifecycle scripts by default. Align your configurations with these native controls for defense-in-depth.

The swamp is murky, but with the right practices, you can keep your packages safe. For more on securing your backend, check out our Supabase Review and Neon Database Review.

Original announcement published on Google Cloud.