Google warns of rise in open source supply chain attacks

Google Threat Intelligence Group and Mandiant have published guidance on defending against software supply chain compromise, focusing on a rise in attacks involving open source software repositories.

The analysis says the most far-reaching incidents tracked in 2025 and early 2026 largely involved code repositories, software dependencies and developer tools, rather than the more traditional tampering of software updates. It argues that open source attacks require less planning and fewer resources, even though malicious packages are often discovered more quickly once they go live.

Researchers said activity increased sharply over the period, with several campaigns using worms and repeated compromises across package ecosystems. They said that pattern marked a notable expansion of the tactic compared with earlier years.

One case highlighted involved UNC6780, also known as TeamPCP, which ran a broad campaign from February to May 2026 across PyPI, npm and Docker Hub. The report says the group used several initial access methods, including abuse of the pull_request_target GitHub Actions trigger to obtain repository secrets and write permissions.

Compromised packages in that campaign were used to deploy credential stealers, including SANDCLOCK. In incident response work, researchers said they had seen attempts to move from compromised artificial intelligence software into wider network environments. Stolen credentials were later monetised through direct sales or links with ransomware and data theft groups.

Another case involved the axios package in the npm ecosystem. A malicious dependency was introduced into the legitimate package after its maintainer account was compromised through social engineering.

Researchers identified the dependency as a dropper for the WAVESHAPER.V2 backdoor and attributed the activity to the North Korean actor MIDNIGHT NEPTUNE. Although the malicious versions were removed within three hours, the impact could still be extensive because axios records more than 100 million weekly downloads and is itself a dependency for tens of thousands of other packages.

Google said it supported customers in at least 15 industry verticals and 13 countries affected by that incident. The malicious axios update also spread into several downstream packages.

AI concerns

The analysis also argues that artificial intelligence is likely to accelerate open source supply chain attacks. It says wider use of AI in software development creates more opportunities for threat actors to manipulate AI-related resources and to use AI tools in their own planning.

The report points to instances in which malicious resources were planted in open source AI communities and harmful code was inserted into open source Model Context Protocol packages. It also cites examples in which AI coding agents incorporated malicious packages into legitimate projects.

Figures from the Open Source Security Foundation show the number of malicious open source packages identified rose by 1,444% from 2024 to 2025. The report presents that as evidence that attacks on package ecosystems have grown rapidly in both volume and impact.

Traditional attacks

By contrast, traditional software supply chain compromise remains rare, the report says. The smaller number of cases identified in 2025 and early 2026 were mainly described as cyber espionage incidents with tightly limited targeting.

The most significant example cited was the theft of cryptocurrency assets valued at an estimated USD $1.4 billion after the North Korean actor UNC4899 reportedly used social engineering to compromise a developer machine at a web3 organisation. The attacker then injected malicious code into front-end systems to alter transactions involving a third party using a multi-signature wallet.

Other incidents included the compromise of infrastructure serving Notepad++ updates, which Google attributes to UNC6688, and the compromise of DAEMON Tools installers in a campaign linked to UNC6863. The latter affected Russia, Brazil and Turkey, with further exploitation of government and scientific entities in Belarus and Thailand.

Defensive steps

The guidance sets out a long list of measures for organisations, starting with better visibility over software assets, vendors and dependencies. It calls for automated software bills of materials, tighter governance over development and deployment changes, and training programmes focused on social engineering and supply chain risk.

On development security, the report recommends short-lived tokens instead of static credentials, stricter controls over repository access, isolated build runners and careful governance of privileged workflow triggers. It also urges companies to keep binaries, packages and container images in monitored internal repositories, and to impose cooling-off periods before newly published third-party code can be used.

Specific advice covers npm and Python environments. The report recommends enforcing a minimum release age of at least 24 hours for npm or pnpm packages, and avoiding direct pulls from the public PyPI registry by requiring a vetted private index URL.

It also advises disabling automatic package install scripts where possible, using software composition analysis tools to scan dependencies, protecting code-signing certificates with hardware security modules, and auditing maintainer accounts for stale or expired email recovery domains.

For monitoring and response, the guidance calls for traffic baselines, endpoint detection on developer systems, centralised logs and supply chain-specific incident playbooks. It says organisations should be prepared for scenarios including maintainer account takeover, dependency confusion, CI/CD pipeline poisoning and developer workstation compromise.

The report says security teams should prioritise attack chains rather than isolated bugs, including combinations such as leaked tokens, weak branch protections and over-privileged trust relationships.