--- title: No Off Season: Three Supply Chain Campaigns Hit npm,... description: Between April 21–23, 2026, three coordinated supply chain attacks targeted npm, PyPI, and Docker Hub with a single objective: stealing secrets from developer... canonical: https://daily.dev/posts/no-off-season-three-supply-chain-campaigns-hit-npm-pypi-and-docker-hub-in-48-hours-fanjdjfdr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: No Off Season: Three Supply Chain Campaigns Hit npm, PyPI, and Docker Hub in 48 Hours | daily.dev og:description: Between April 21–23, 2026, three coordinated supply chain attacks targeted npm, PyPI, and Docker Hub with a single objective: stealing secrets from developer... og:url: https://daily.dev/posts/no-off-season-three-supply-chain-campaigns-hit-npm-pypi-and-docker-hub-in-48-hours-fanjdjfdr og:image: https://api.daily.dev/og/posts/FanjdJFDR.png og:image:alt: No Off Season: Three Supply Chain Campaigns Hit npm, PyPI, and Docker Hub in 48 Hours og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # No Off Season: Three Supply Chain Campaigns Hit npm, PyPI, and Docker Hub in 48 Hours **[GitGuardian](https://daily.dev/sources/gitguardian)** · 3 min read · 0 upvotes · 0 comments ## Summary Between April 21–23, 2026, three coordinated supply chain attacks targeted npm, PyPI, and Docker Hub with a single objective: stealing secrets from developer environments and CI/CD pipelines. Campaign 1 compromised official Checkmarx KICS Docker images and VS Code extensions, harvesting GitHub tokens, AWS/Azure/GCP credentials, SSH keys, and environment variables. Campaign 2 (CanisterSprawl) injected a self-propagating worm into the pgserve npm package that steals publish tokens, republishes itself to victim packages, and can jump to PyPI if a token is found — using an Internet Computer Protocol canister as a decentralized C2. Campaign 3 saw three consecutive malicious releases of xinference on PyPI attributed to TeamPCP, stealing SSH keys, cloud credentials, and crypto wallets. All three attacks focused on credential exfiltration rather than disrupting builds, and teams are urged to audit what secrets were accessible and rotate them immediately. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Four Credential-Harvesting Campaigns Hit Open Source Ecosystems in Two Weeks](https://daily.dev/posts/four-credential-harvesting-campaigns-hit-open-source-ecosystems-in-two-weeks-gtsbqgosw) · GitGuardian · 1 upvotes · 0 comments - [Four More Supply Chain Attacks Hit npm and PyPI](https://daily.dev/posts/four-more-supply-chain-attacks-hit-npm-and-pypi-g68buqqbp) · GitGuardian · 7 upvotes · 0 comments - [Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure](https://daily.dev/posts/weaponizing-the-protectors-teampcp-s-multi-stage-supply-chain-attack-on-security-infrastructure-fxtlie1qu) · Unit 42 · 0 upvotes · 0 comments - [The State of Open Source Supply Chain Attacks](https://daily.dev/posts/the-state-of-open-source-supply-chain-attacks-6n0c8tjb5) · StepSecurity · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/no-off-season-three-supply-chain-campaigns-hit-npm-pypi-and-docker-hub-in-48-hours-fanjdjfdr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"No Off Season: Three Supply Chain Campaigns Hit npm, PyPI, and Docker Hub in 48 Hours","url":"https://daily.dev/posts/no-off-season-three-supply-chain-campaigns-hit-npm-pypi-and-docker-hub-in-48-hours-fanjdjfdr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/no-off-season-three-supply-chain-campaigns-hit-npm-pypi-and-docker-hub-in-48-hours-fanjdjfdr"},"datePublished":"2026-04-23T09:33:50.447Z","dateModified":"2026-04-23T09:34:21.736Z","description":"Between April 21–23, 2026, three coordinated supply chain attacks targeted npm, PyPI, and Docker Hub with a single objective: stealing secrets from developer...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/83926986126395dd01c067401320c29a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/83926986126395dd01c067401320c29a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitGuardian","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitGuardian","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/406f3b707b1741f7b988cf561463a54d","url":"https://daily.dev/sources/gitguardian"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/no-off-season-three-supply-chain-campaigns-hit-npm-pypi-and-docker-hub-in-48-hours-fanjdjfdr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,python,malware,npm,secrets-management","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitGuardian","item":"https://daily.dev/sources/gitguardian"},{"@type":"ListItem","position":3,"name":"No Off Season: Three Supply Chain Campaigns Hit npm, PyPI, and Docker Hub in 48 Hours"}]} ```