Loading story…
A supply-chain compromise in the react-tracked GitHub repository led to attacker-controlled code execution during npm install after malicious commits briefly landed on the default branch. The implant added src/install.js and a postinstall hook that fetched and evaluated a remote JavaScript payload from an attacker-controlled HTTPS endpoint, disabled TLS verification, and avoided CI and cloud or serverless environments to focus on developer workstations. Although the tainted code was never published to npm and was later force-pushed away, any developer who installed from an affected checkout, fork, local clone, or direct commit reference may have been exposed; impacted systems should be treated as fully compromised and reachable credentials rotated.
The incident fits a broader wave of developer-focused software supply-chain attacks that has intensified across GitHub, npm, PyPI, Docker Hub, and CI/CD environments. Recent reporting tied the March 2026 compromises of tools including Trivy, Checkmarx KICS, and LiteLLM to TeamPCP, a threat cluster Oligo Security says overlaps with the longer-running TA-NATALSTATUS and ShadowRay 2.0 activity through shared infrastructure, staging paths, and deployment scripts. Researchers say these campaigns increasingly abuse trusted developer platforms, steal tokens, and use malicious repositories, workflows, and packages to reach workstations and cloud-connected build environments.
Trace attribution and downstream blast radius.
15 events from the most recent confirmed update back to the earliest known activity.
On August 5, Oligo Security published research linking TeamPCP to TA-NATALSTATUS activity from 2020 through August 2025 and to the 2025 ShadowRay 2.0 campaign, concluding TeamPCP is part of an existing operational ecosystem rather than a newly emerged actor.
The malicious react-tracked commits remained on the default branch until 2026-05-19 15:22:45, when they were removed by force-push, though affected local clones, forks, and direct-SHA references could still retain them.
Malicious commits were present on the react-tracked default branch from 2026-05-18 19:26:36, adding src/install.js and a postinstall path that fetched and evaluated attacker-controlled code during npm install.
By May 2026, TeamPCP had leaked the source code of its malware and called on other hackers to conduct large-scale supply-chain attacks, according to Silobreaker.
In late March 2026, a second-stage Kubernetes payload gained a destructive branch that checked for the Iran timezone and, if matched, deployed a workload that deleted filesystems and rebooted the machine.
Multiple references describe TeamPCP as the group behind large-scale March 2026 supply-chain compromises affecting open-source developer tools, including Trivy, Checkmarx KICS, and LiteLLM, with CanisterWorm used in the campaign.
Oligo said TeamPCP operated ShadowRay 2.0, a campaign documented in November 2025 against exposed Ray clusters and previously attributed to an actor named IronErn440.
Between November 2 and November 4, the ironern440 account authenticated to GitLab from the same IP address that hosted the campaign's tooling, strengthening Oligo's linkage between ShadowRay 2.0 and TeamPCP.
One IP address received reverse shells from a compromised Ray cluster between October 15 and November 2, tying campaign tooling to the ShadowRay 2.0 activity chain.
A compromised Ray cluster logged a download from infrastructure later linked to TeamPCP on July 26, 2025, months before the TeamPCP name surfaced publicly.
Certificate transparency records dated the masscan[.]cloud domain to May 11, 2025; Oligo later linked this domain to TA-NATALSTATUS, ShadowRay 2.0, and TeamPCP operations.
Oligo's activity progression includes PCPcat peaking around Christmas 2025, targeting React2Shell victims and exposed Docker APIs.
Silobreaker states that TeamPCP has used its Shai-Hulud credential-stealing malware since at least mid-2025 across targets including GitHub Actions, npm, Docker Hub, OpenVSX, VS Code extensions, and internal GitHub repositories.
The Silobreaker article says the North Korea-linked Contagious Interview campaign has been ongoing since at least late 2022, using fake recruiter lures and malicious coding tasks to trick developers into running poisoned repositories and tools.
Oligo Security's timeline places the operators later linked to TeamPCP as exploiting internet-facing infrastructure as early as 2020, using automated and wormable techniques.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourceinfosecurity-magazine.com
Open sourcesilobreaker.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are using **malicious npm packages** to steal developer credentials and CI/CD secrets, enabling rapid escalation into cloud environments. Google reported that **UNC6426** leveraged keys stolen during the earlier compromise of the *nx* npm ecosystem to pivot from a stolen developer GitHub token into **AWS administrative access within 72 hours**, abusing **GitHub-to-AWS OpenID Connect (OIDC) trust** to create a new admin role. The actor then used that access to **exfiltrate data from AWS S3** and conduct **destructive actions** in production cloud environments; the initial *nx* compromise involved a GitHub Actions `pull_request_target` workflow abuse (“**Pwn Request**”) that enabled publishing trojanized packages containing a `postinstall` chain that executed the **QUIETVAULT** JavaScript credential stealer and uploaded stolen data to a public GitHub repo (`/s1ngularity-repository-1`). Separately, researchers reported new waves of the **PhantomRaven** npm supply-chain campaign distributing **88 additional malicious packages** (via ~50 disposable accounts) that target JavaScript developers by exfiltrating secrets from files like `.gitconfig` and `.npmrc`, environment variables, and CI/CD tokens (e.g., GitHub/GitLab/Jenkins/CircleCI). The campaign uses **slopsquatting** (LLM-suggested lookalike package names) and a stealth technique called **Remote Dynamic Dependencies (RDD)**, where `package.json` pulls a dependency from an external URL so the malicious payload is fetched at install time (`npm install`) and can evade static package inspection; researchers indicated many of these packages remained available in the npm registry at the time of reporting.
Jun 29, 2026
Security researchers reported multiple **software supply chain** threats targeting developers via public package ecosystems. Tenable analyzed a malicious npm package, **`ambar-src`**, that reached roughly **50,000 downloads** in days before removal; it executed during installation via **malicious `preinstall` behavior**, used evasion techniques, and dropped OS-specific payloads for Windows, Linux, and macOS, with typosquatting assessed as the likely lure (mimicking *`ember-source`*). Separate reporting described a campaign using **malicious NuGet packages** (e.g., **NCryptYo**, **DOMOAuth2_**, **IRAOAuth2.0**, **SimpleWriter_**) that impersonated legitimate .NET libraries, executed code on assembly load, and established local proxying/backdoor behavior to facilitate credential theft and persistence in ASP.NET environments. Additional coverage warned of an npm “worm-like” propagation pattern impacting **CI pipelines and AI coding tools**, reinforcing that developer tooling and build systems are high-risk choke points where a single poisoned dependency can spread quickly across environments. While the broader set of articles also included unrelated breach, ransomware, and policy items, the developer-focused supply chain reporting consistently emphasized that **installation-time execution** and **typosquatting/impersonation** enable compromise even when developers never directly call the malicious code, and that traditional detection can lag (e.g., low initial antivirus detection rates for obfuscated .NET payloads).
Jun 29, 2026
Open-source software supply chain risk continued to escalate, with reporting citing **454,600+** newly identified malicious packages across major repositories (including **PyPI, npm, Maven Central, NuGet, and Hugging Face**) and tactics ranging from **credential theft** to **multi-stage attacks** and even early **self-replicating** package malware. The activity reportedly concentrated heavily in **npm**, including high-volume “ecosystem flooding” (e.g., single accounts publishing **150,000+** malicious packages in days) and **hijacking of trusted projects**, exploiting developer reliance on superficial trust signals such as package names, READMEs, and download counts. Separately, researchers disclosed **“PackageGate”** vulnerabilities in JavaScript package managers (**npm, pnpm, vlt, and Bun**) that can bypass common post-incident defenses—namely `--ignore-scripts` and lockfile integrity—enabling malicious code execution via compromised dependencies. Koi Security reported six issues; **pnpm, vlt, and Bun** shipped fixes, while **npm** reportedly treated the behavior as expected. In parallel, threat actors abused **GitHub’s fork architecture** to distribute a spoofed *GitHub Desktop* installer promoted via search ads; execution deployed **HijackLoader** and established persistence via a **scheduled task**, underscoring that supply chain threats extend beyond package registries into developer tooling distribution channels.
Jun 29, 2026