Google Draws Attention to Vulnerabilities in Open-Source Software Supply Chains
In a recent analysis, Google has expressed significant concern regarding the growing trend of compromises within the open-source supply chain. The tech giant highlights that these types of attacks have proven to be easier to execute and propagate compared to traditional supply-chain vulnerabilities. As a result, this method has become an increasingly enticing strategy for cybercriminals, with indications that its prevalence is set to soar.
According to Google, the year 2025, along with the early parts of 2026, marked a stark increase in the exploitation of open-source code repositories, software dependencies, and essential developer tools. One particularly alarming episode involved TeamPCP, which deployed two waves of malware known as Shai-Hulud, drastically impacting open-source software with weekly downloads estimated to be around 20 million. Furthermore, TeamPCP’s ongoing campaigns this year compromised packages responsible for a staggering 100 million weekly downloads. Such extensive infiltration strategies signal a worrying trend, as attackers seek to capitalize on the popularity and widespread trust in these resources.
The Google Threat Intelligence Group has reported that they assess with "high confidence" that the scale and complexity of these assaults represent an unprecedented expansion in the use of open-source supply-chain compromise tactics. The organization warns that threat actors are likely to adopt similar strategies in the future, which may lead to even greater incidents throughout 2026 and beyond.
Moreover, the integration of artificial intelligence functionalities into open-source systems has opened up new attack avenues, further exacerbating the risks of software compromises. Google also flagged a notable incident involving a North Korean hacking group known as Midnight Neptune. This group managed to breach the maintainer account of the popular axios package—a widely-utilized HTTP client—through social engineering techniques. They subsequently published a malicious dependency via package updates. Although the malicious versions were removed within three hours of their appearance on the npm registry, the potential damage was extensive, given that axios enjoys over 100 million weekly downloads. The fallout from this incident was significant, affecting at least 15 industries across 13 countries.
Not limited to just axios, the ramifications spread far and wide as the compromised package also serves as a dependency for tens of thousands of other software packages, influencing frontend frameworks, backend services, and enterprise applications throughout the JavaScript ecosystem, as reported by open-source research firm Socket.
In another disturbing instance, TeamPCP (also identified by the moniker UNC6780) orchestrated an extensive campaign that leveraged trusted packages to disperse credential-stealing malware and gain access to downstream environments. A prime example from this campaign involved the theft of 3,800 internal GitHub repositories, achieved via a compromised Visual Studio Code extension. This breach also included actions related to the Trivy vulnerability scanner and AI-focused tools such as LiteLLM.
TeamPCP employed compromised PyPI packages and malicious pull requests as their operational tactics to infiltrate GitHub repositories, ultimately deploying malware designed to extract sensitive data from developer environments. Google detailed in a blog post that the Sandclock credential stealer was instrumental in harvesting secrets from cloud services like AWS and GitHub.
The incorporation of AI in the software supply chain has not only increased the number of entry points for malicious actors but also expanded the scope of potential damage. The compromise of AI software utilized by various large language model providers significantly broadened the risk landscape, resulting in considerable exposure of API secrets that could be exploited to further these cyber intrusions.
In one illustrated incident, attackers injected malicious code into the Hugging Face AI development platform’s repository, collecting around 200,000 downloads. Furthermore, a malicious npm package masquerading as a legitimate Postmark MCP server conducted nefarious activities, including BCCing an attacker on each outgoing email, thus revealing sensitive documents and invoices.
Vulnerabilities in coding practices represent fertile ground for nation-state actors, as evidenced by the exploits of the North Korea-linked group Famous Chollima. This group managed to manipulate an AI coding agent to incorporate a malicious package as a dependency in a cryptocurrency trading project, designed to facilitate unauthorized access to users’ crypto wallets and pilfer their funds.
Supporting Google’s assertions, data gathered by the Open Source Security Foundation, a cross-industry entity affiliated with the Linux Foundation, indicates a staggering 1,444% increase in the identification of malicious open-source software packages from 2024 to 2025. Such statistics serve as a clarion call for the tech community to enhance their scrutiny of open-source software, as they navigate the realities of a swiftly evolving cyber threat landscape.