GTIG: 2026 OSS Supply Chain Compromise, Credential Theft, and Self-Propagation

1. Basic Information

  • Article Title: Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise
  • Publisher: Google Threat Intelligence Group / Mandiant
  • Publication Date: 2026-07-30
  • Original URL: https://cloud.google.com/blog/topics/threat-intelligence/mitigation-guidance-for-supply-chain-compromise/
  • Related Sources: TeamPCP, axios, and WAVESHAPER.V2 investigations within the article
  • Related Entities: UNC6780/TeamPCP, SANDCLOCK, MIDNIGHT NEPTUNE/UNC1069, WAVESHAPER.V2, npm, PyPI, Docker Hub, GitHub Actions, axios
  • Severity: High

2. Executive Summary

Attackers are stealing credentials from developers, maintainers, and CI/CD pipelines to tamper with legitimate packages. This attack model is growing on a large scale: it steals cloud secrets from user environments, self-propagates to other packages, and leads to ransomware or extortion.

3. Attack Flow

UNC6780 / TeamPCP

  1. Attackers gain write permissions by abusing GitHub Actions pull_request_target, compromising maintainer accounts, or publishing malicious packages.
  2. They inject malicious code into legitimate and spoofed packages on PyPI, npm, and Docker Hub.
  3. Users execute the code during installation on their development devices or in CI/CD pipelines.
  4. Tools like SANDCLOCK steal credentials for the cloud, CI/CD, and package registries.
  5. Attackers tamper with other packages owned by the victim to spread like a worm.
  6. They pivot from AI software into wider enterprise networks.
  7. They monetize the stolen credentials by selling them or partnering with ransomware and data extortion groups.

axios / MIDNIGHT NEPTUNE

  1. Attackers compromise maintainer accounts using social engineering.
  2. They add malicious dependencies to the legitimate axios package and publish a new version.
  3. Dependency resolution spreads the package to many users and downstream packages.
  4. A dropper deploys the WAVESHAPER.V2 backdoor.

4. Attacker Position and Execution Locations

Attackers compromise the control planes of source hosting services, CI/CD pipelines, and package registries. The malicious code runs on developer devices, build runners, containers, and application execution environments. It then uses stolen credentials to move into the cloud and other repositories.

5. Visibility for Victims and Administrators

  • The packages look legitimate, use real names, have valid signers, and appear as normal dependency updates.
  • CI logs show install scripts, added dependencies, outbound network traffic, and secret access.
  • Even if individual devices show no warnings, many environments using the same lockfile, cache, or container image are affected at the same time.

6. Success and Failure Conditions

Success Conditions

  • Maintainer and CI tokens are vulnerable to phishing and have long lifespans.
  • pull_request_target or similar events give secrets and write permissions to untrusted code.
  • Install scripts, outbound network traffic, and dependency updates are unrestricted.
  • Malicious versions remain in caches, lockfiles, and container images.

Failure Conditions

  • Phishing-resistant MFA, short-lived OIDC, and issued tokens with minimum privileges.
  • Secrets are not passed to CI events that cross trust boundaries.
  • Pinned dependencies, signature and provenance verification, restricted install scripts, and egress control.
  • Compromised versions are removed from all caches and build artifacts, not just the registry.

7. What Happens Upon Success

Developer, CI/CD, and cloud credentials, source code, and customer data are stolen, and malicious packages self-propagate downstream. GTIG reported that the axios incident affected customers across 13 countries and 15 industries, showing that dependencies with over 100 million weekly downloads have a massive impact.

8. Observable Logs

  • Email: Phishing targeting maintainers, or messages pretending to be from registries or GitHub.
  • Proxy/SWG/DNS: Unknown outbound traffic during installs or builds, sending credentials, and downloading malicious packages.
  • Endpoint/EDR: Package manager child processes, install scripts, secret file reads, WAVESHAPER.V2 / SANDCLOCK activity.
  • Identity/IdP: Abnormal use of maintainer accounts, Personal Access Tokens (PATs), npm/PyPI tokens, and cloud keys.
  • SaaS/Cloud: GitHub Actions, pull_request_target, releases, package publishing, OIDC, and audit logs.
  • Network: Abnormal egress from CI runners or developer devices, followed by cloud API access and internal reconnaissance.

9. Attack Success Assessment

  • Contact Only: Phishing, malicious PRs, or referencing a malicious version.
  • User Action: Maintainer authentication, PR approval, dependency updates.
  • Initial Execution: Malicious code execution during install or build.
  • Malware or Successful Auth: SANDCLOCK/WAVESHAPER.V2 activity, use of stolen tokens.
  • Data Theft / Session Compromise: Sending secrets, source code, or cloud data.
  • Subsequent Compromise Confirmation: Publishing other packages, cloud and network pivoting, extortion, or ransomware.

10. Investigation Playbook

  • Trigger: Known compromised version, unexpected publish event, unknown egress from CI, abnormal token use.
  • Initial Check: Identify SBOMs, lockfiles, caches, images, installation times, and execution environments.
  • Devices: Investigate package managers, install scripts, child processes, secret access, and build artifacts.
  • Auth & Cloud: Track the use and issuance of all GitHub, registry, CI, and cloud tokens.
  • Subsequent Actions: Check all packages the victim has permission to publish, downstream dependencies, cloud APIs, and data transmissions.
  • Containment: Stop builds, revoke tokens, remove malicious dependencies, caches, and artifacts, rebuild from known good sources, and notify downstream users.
  • Assessment Levels: Referenced / Downloaded / Executed / Credential Stolen / Package Republished / Cloud Pivot / Exfiltration or Ransomware.

11. Defense and Detection Ideas

  • Single Event: Publishing from a new device, CI pull_request_target with secrets, shell execution during install, or unexpected dependency additions.
  • Timeline Correlation: Abnormal maintainer login -> release/publish -> CI install -> secret read -> publishing another package.
  • Hunting: Reverse-lookup compromised versions and transitive dependencies from SBOMs, and search across the environment for the use of the same tokens and infrastructure.
  • Log Gaps: Without package registry logs, CI job logs, provenance data, and developer device egress logs, you cannot determine the full scope of impact.
  • Priority Countermeasures: Phishing-resistant MFA, short-lived OIDC, pinned dependencies, signatures/provenance, isolated CI environments, secret scanning, and egress control.

12. Facts / Inference / Hypothesis

Facts

  • GTIG assesses with high confidence that the scale, repetition, and worm-like nature of OSS supply chain attacks increased between 2025 and early 2026.
  • TeamPCP targeted PyPI, npm, and Docker Hub, stole secrets using tools like SANDCLOCK, and tried to pivot from AI software into wider enterprise networks.
  • In the axios incident, the malicious version was removed within three hours, but the impact reached customers in 13 countries across 15 industries.

Inference

  • Simply deleting a package from the registry does not secure existing caches, lockfiles, container images, or stolen credentials.
  • Organizations worldwide are simultaneously affected through global OSS dependencies.

Hypothesis

  • Correlating publish authentication events with downstream CI secret access can help contain attacks before self-propagation occurs.

13. MITRE ATT&CK Mapping

  • High Confidence: T1195.001 Compromise Software Dependencies and Development Tools, T1552 Unsecured Credentials, T1078 Valid Accounts, T1105 Ingress Tool Transfer.
  • Medium Confidence: T1528 Steal Application Access Token, T1098 Account Manipulation, T1041 Exfiltration Over C2, T1486 Data Encrypted for Impact (if executed by affiliates).

14. Unknowns and Additional Investigation

  • Complete IOCs and lists of compromised packages for each campaign.
  • The specific scope of how AI was used to plan attacks and generate malicious code.
  • Residual presence in domestic organizations or local mirrors.
  • Individual cases linking stolen credential sales and ransomware operations.

15. Impact on SOCs and General Enterprises

Even in local development environments, reliance on npm, PyPI, Docker Hub, and GitHub Actions is high. SOCs must monitor not only production servers but also developer identities, CI runners, package publishing, SBOMs, and build egress. Organizations need to coordinate security responses across development, cloud, and CSIRT teams.

16. Summary by Target Audience

  • For SOCs: Track identities, publishing events, package installs, secret reads, and downstream publishing as a single supply chain.
  • For Administrators: Make CI secrets short-lived and properly manage dependencies, signatures, provenance, and caches.
  • For Users: Developers should not blindly approve dependency updates or authentication requests directed at maintainers.