Open-source supply-chain wave status: eight vendors converged on one compromise inside 48 hours, and the week's operational order inverts incident-response reflex — hunt and remove the host persistence before rotating any credential, because revocation is its trigger
UPDATE · originally covered Open-source supply-chain wave status: a second vendor assesses the escalation at high confidence, the CI trigger that hands over base-repository secrets is named, and two vendors independently attribute the axios compromise to the same DPRK cluster (2026-08-02)
the wave prior weeklies tracked from install-hook evasion, through abuse of the trust machinery around packages, to poisoned AI coding-assistant tool configurations produced its largest single event this week. Two things changed at week level that the day-by-day entries do not carry.
The first is that what looked like two events is one. The compromise of the keyv and cacheable npm namespaces, reported on 4 August by Socket and independently by several other vendors within roughly 48 hours, is the same wave this pipeline covered as CHAINDROP two days later: Socket traces it to a compromised maintainer account whose packages "were published with a malicious preinstall hook (setup.mjs) that downloads a standalone Bun runtime, executes an obfuscated second stage, harvests cloud and CI credentials, and republishes trojanized versions of other packages the stolen npm token can reach" (Socket Threat Research, 2026-08-04), the same mechanics Elastic and Unit 42 later detailed under the CHAINDROP name. The reach matters because of where these packages sit: keyv resolves as a transitive dependency beneath common tooling rather than as something teams install deliberately, so most affected estates never chose it.
The second delta is an operational order that inverts the standard reflex, and it is the reason this status entry exists rather than a line in the roll-up. Socket documents a host-level dead-man's switch installed alongside the credential theft — a watcher registered as a launch agent on macOS and as a lingering user-level service on Linux, polling the GitHub API with the stolen token roughly once a minute. Its instruction to responders is explicit: "Before rotating any credential, hunt for and remove the host-level dead-man's switch. Revocation is its trigger: the watcher runs eval on a remote-supplied handler the moment the stolen token returns an HTTP 4xx." Every incident-response playbook opens with credential rotation; on this campaign that step executes attacker code on the host. The corollary for anyone who has already rotated is that the switch has already fired, and the host needs treating accordingly.
Alongside that, the cross-vendor convergence hardened the strategic conclusion the operational entries reached from the other direction. Unit 42's analysis found a path that trades a runner OIDC token at npm's trusted-publishing endpoint for a real publish credential and then signs the result through the public transparency infrastructure, producing provenance it is explicit is not forged (Unit 42, 2026-08-06). Socket states the general form: "provenance attests build integrity, not source integrity. The npm and sigstore pipeline did exactly what it is designed to do and still produced a signed, verifiable attestation for malware, because the source it built from was already trojanized." An organisation that added provenance verification to its dependency policy in the past year — a reasonable thing to have done — has a control that would have passed this package.
Triage: the credential-harvesting stage runs at install time from a package manager's process tree, which is the discriminator against ordinary developer activity — build scripts legitimately spawn interpreters, but a package install that downloads and executes a fresh language runtime is not a normal build step. For the persistence, the artefacts Socket names are a user-scoped launch agent and a lingering user-level service whose job is to make an HTTP request on a timer; a periodic outbound API call from a user-level service on a developer laptop is unremarkable in isolation, and is the signal when it appeared in the same window as a package installation.
Before rotating any credential, hunt for and remove the host-level dead-man's switch. Revocation is its trigger: the watcher runs eval on a remote-supplied handler the moment the stolen token returns an HTTP 4xx.
The lesson is that provenance attests build integrity, not source integrity. The npm and sigstore pipeline did exactly what it is designed to do and still produced a signed, verifiable attestation for malware, because the source it built from was already trojanized.
Defender actions
- Before revoking or rotating any npm, GitHub, cloud or SSH credential on a developer or CI host that installed an affected package, first locate and remove the token-watcher persistence Socket documents — the launch agent, the user-level systemd service and its configuration directory — because revocation is what makes the watcher execute its remote handler.
ATT&CK mapping
6 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
T1195.002Supply Chain Compromise: Compromise Software Supply Chain
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
Persistence TA0003
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
T1543.001Create or Modify System Process: Launch Agent
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>~/Library/LaunchAgents</code>. Property list files use the <code>Label</code>, <code>ProgramArguments </code>, and <code>RunAtLoad</code> keys to identify the Launch Agent's name, executable location, and execution time. Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.
T1543.002Create or Modify System Process: Systemd Service
Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources. Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
Privilege Escalation TA0004
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
T1543.001Create or Modify System Process: Launch Agent
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>~/Library/LaunchAgents</code>. Property list files use the <code>Label</code>, <code>ProgramArguments </code>, and <code>RunAtLoad</code> keys to identify the Launch Agent's name, executable location, and execution time. Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.
T1543.002Create or Modify System Process: Systemd Service
Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources. Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
Stealth TA0005
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Credential Access TA0006
T1552.001Unsecured Credentials: Credentials In Files
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Command and Control TA0011
T1071.004Application Layer Protocol: DNS
Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Sources
Update chain
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.