Open-source supply-chain wave status: a second vendor assesses the escalation at high confidence, the CI trigger that hands over base-repository secrets is named, and two vendors independently attribute the axios compromise to the same DPRK cluster
UPDATE · originally covered npm / AI-developer-toolchain supply-chain wave status: this week the front edge moved from poisoning packages to poisoning the AI coding assistant's own trust config, via rogue MCP tool-provider entries (2026-07-26)
the prior weekly tracked this wave's front edge moving into the AI coding assistant's own trust configuration. This week the wave gained something it had lacked — independent cross-vendor agreement on who is running a significant part of it, and a named CI mechanism defenders can go and check.
Amazon published an attribution assessment covering three of the ecosystem's most consequential compromises, stating that "based on analysis of command-and-control (C2) indicators and TTPs, Amazon Threat Intelligence assesses with medium confidence that these campaigns are attributable to the DPRK-linked threat actor tracked as SAPPHIRE SLEET" — a cluster it also names as STARDUST CHOLLIMA, BlueNoroff, CageyChameleon and Alluring Pisces (AWS Security Blog, 2026-07-29). The access mechanism is consistent and is not a platform weakness: "in each case, the threat actor gained access by socially engineering a trusted maintainer of the package, then published a software update containing malicious code." (AWS Security Blog, 2026-07-29). Amazon also assesses that a small March 2025 compromise served as a testing ground for the more visible operations that followed (AWS Security Blog, 2026-07-29), and identifies an evasion design that has direct implications for how organisations scan: the payload "is designed to defeat scanners that evaluate packages one by one instead of reasoning about how they interact in a real dependency graph" (AWS Security Blog, 2026-07-29).
Google's threat-intelligence group published defender-facing guidance a day later and reached the same attribution independently, attributing the activity to an actor it now calls MIDNIGHT NEPTUNE, formerly known as UNC1069 (Google Cloud Blog, 2026-07-30). Neither vendor states the equivalence itself; the reporting on Amazon's briefing does, recording that "security researchers track the group under several names, including UNC1069, Sapphire Sleet and Stardust Chollima" (CyberScoop, 2026-07-29) — which is what makes this two vendors looking rather than one vendor being repeated. Its own assessment of the trend is unhedged on direction: "GTIG assesses with high confidence that the growth in very large-scale, open-source supply chain compromise campaigns, including use of worms and iterative compromises in 2025 and early 2026, represent a significant expansion in use of this tactic compared to prior years." (Google Cloud Blog, 2026-07-30).
The most immediately actionable content is a named CI mechanism belonging to a different cluster: "UNC6780 (aka \"TeamPCP\") conducted extensive open source supply chain compromises targeting ecosystems like PyPI, npm, and Docker Hub. Initial infection vectors varied across incidents, and included abuse of the pull_request_target GitHub Actions trigger to obtain base repository secrets and write permissions." (Google Cloud Blog, 2026-07-30). That trigger is worth singling out because it is not a misconfiguration in the usual sense — pull_request_target runs workflow code in the context of the base repository, with its secrets, deliberately, so a workflow that checks out or executes anything from the incoming fork hands those secrets to whoever opened the pull request. It is a design that behaves exactly as documented and is very easy to use wrongly.
Based on analysis of command-and-control (C2) indicators and TTPs, Amazon Threat Intelligence assesses with medium confidence that these campaigns are attributable to the DPRK-linked threat actor tracked as SAPPHIRE SLEET
In each case, the threat actor gained access by socially engineering a trusted maintainer of the package, then published a software update containing malicious code.
This approach is designed to defeat scanners that evaluate packages one by one instead of reasoning about how they interact in a real dependency graph.
GTIG assesses with high confidence that the growth in very large-scale, open-source supply chain compromise campaigns, including use of worms and iterative compromises in 2025 and early 2026, represent a significant expansion in use of this tactic compared to prior years.
UNC6780 (aka "TeamPCP") conducted extensive open source supply chain compromises targeting ecosystems like PyPI, npm, and Docker Hub. Initial infection vectors varied across incidents, and included abuse of the pull_request_target GitHub Actions trigger to obtain base repository secrets and write permissions.
While the malicious versions of axios were removed from the npm registry within three hours of their release, the scope of the compromise is estimated to be broad, as the package has over 100 million weekly downloads.
Setting this value to at least 24 hours (1440 minutes) ensures that freshly published, potentially poisoned packages are quarantined until the broader security community has had time to identify and remove them
Defender actions
- Audit every GitHub Actions workflow in your organisation that uses the pull_request_target trigger and confirm none exposes base-repository secrets or write permissions to code from a fork — this is the specific mechanism GTIG names UNC6780 as having abused across npm, PyPI and Docker Hub, and a workflow using that trigger runs with the base repository's privileges by design rather than by misconfiguration.
- Set a minimum release-age cooldown of at least 24 hours on npm and pnpm installs across CI and developer environments, so a freshly-published malicious version is quarantined during the window in which these compromises are typically caught and pulled — the malicious axios versions were removed from the registry within about three hours of release.
ATT&CK mapping
5 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1195.001Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency. This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries. Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.
T1195.002Supply Chain Compromise: Compromise Software Supply Chain
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
T1199Trusted Relationship
Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.
Stealth TA0005
T1027Obfuscated Files or Information
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Command and Control TA0011
T1105Ingress Tool Transfer
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).
Update chain
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.