As cited
Citation snapshot as of .
threat intel
Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise
Google Threat Intelligence Group and Mandiant report a significant increase in open source software supply chain compromise campaigns during 2025 and early 2026, with threat actors targeting code repositories, package managers like PyPI and npm, and developer tools. Notable incidents include UNC6780's multi-month campaign deploying credential stealers across multiple ecosystems and a North Korean actor's compromise of the axios package to distribute a backdoor. The researchers assess that open source compromises require fewer resources than traditional supply chain attacks but are discovered more quickly once deployed.
Why it matters: Any organization using open source dependencies faces exposure to these increasingly frequent and large-scale campaigns; practitioners should implement the recommended defensive strategies and monitor their supply chain for compromised packages, particularly in Python, Node.js, and container ecosystems.
- Source published
- First seen by Cybersecurity Tracker