--- title: The State of Open Source Supply Chain Attacks | daily.dev description: StepSecurity's threat intelligence team tracked 56 confirmed open source supply chain attacks between August 2025 and August 2026, roughly one every three days... canonical: https://daily.dev/posts/the-state-of-open-source-supply-chain-attacks-6n0c8tjb5 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The State of Open Source Supply Chain Attacks | daily.dev og:description: StepSecurity's threat intelligence team tracked 56 confirmed open source supply chain attacks between August 2025 and August 2026, roughly one every three days... og:url: https://daily.dev/posts/the-state-of-open-source-supply-chain-attacks-6n0c8tjb5 og:image: https://api.daily.dev/og/posts/6N0c8tJB5.png og:image:alt: The State of Open Source Supply Chain Attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The State of Open Source Supply Chain Attacks **[StepSecurity](https://daily.dev/sources/stepsecurity)** · 11 min read · 0 upvotes · 0 comments ## Summary StepSecurity's threat intelligence team tracked 56 confirmed open source supply chain attacks between August 2025 and August 2026, roughly one every three days since March 2026, up from about one per month before that. The report distinguishes malicious compromises from vulnerabilities and highlights the rise of self-propagating worms like Shai-Hulud, CanisterWorm, Miasma, and ChainDrop. A five-day Team PCP campaign in March 2026 stole 78,330 secrets from 2,186 organizations, including 92 public companies. GitHub Actions emerged as a primary target through mutable version tags, runner credential theft, and workflow-based secret harvesting, while attacks spread across npm, PyPI, RubyGems, Composer, and crates.io. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many open source supply chain attacks happened between August 2025 and August 2026? StepSecurity's threat intelligence team confirmed 56 distinct supply chain attacks across npm, PyPI, RubyGems, Composer, and crates.io during that period, each triggering a real-time alert with indicators of compromise. The rate rose sharply starting March 2026, from roughly one attack per month to about one every three days, with 13 incidents in March alone and 50 of the 56 total occurring after February 2026. _Teams tracking supply chain risk trends can follow attack data and defenses like these on daily.dev._ ### What was the Team PCP supply chain attack campaign in March 2026? Team PCP ran a five-day campaign from March 19 to 24, 2026, compromising widely trusted components including the Trivy GitHub Action (76 of 77 version tags), the Checkmarx KICS Action, the telnyx PyPI package, and LiteLLM, then harvesting CI/CD credentials from memory. The campaign stole 78,330 secrets from 2,186 organizations, including 92 public companies worth a combined $6.2 trillion. _Developers assessing CI/CD credential exposure can keep up with campaigns like this via daily.dev._ ### How does the Shai-Hulud npm worm spread and why is it dangerous? Shai-Hulud, first seen in September 2025, compromised over 500 npm packages by stealing each victim's npm token and using it to automatically infect every package that maintainer published, making it the first supply chain attack to self-propagate at ecosystem scale. Variants followed, including Sha1-Hulud in November 2025 hitting Zapier and ENS Domains, and mini variants targeting SAP and TanStack packages in 2026. _Developers guarding against self-propagating npm worms can track new variants and mitigations on daily.dev._ ## Similar posts on daily.dev - [5 Supply Chain Attacks in 48 Hours: Why Securing One Layer Is Not Enough](https://daily.dev/posts/5-supply-chain-attacks-in-48-hours-why-securing-one-layer-is-not-enough-wlypxlj48) · StepSecurity · 0 upvotes · 0 comments - [Four Credential-Harvesting Campaigns Hit Open Source Ecosystems in Two Weeks](https://daily.dev/posts/four-credential-harvesting-campaigns-hit-open-source-ecosystems-in-two-weeks-gtsbqgosw) · GitGuardian · 1 upvotes · 0 comments - [Mitigation Guidance for Supply Chain Compromise](https://daily.dev/posts/mitigation-guidance-for-supply-chain-compromise-2fj8w1sqx) · Google Cloud · 0 upvotes · 0 comments - [Modern supply-chain attacks and their real-world impact](https://daily.dev/posts/modern-supply-chain-attacks-and-their-real-world-impact-goucs5roh) · CSO Online · 0 upvotes · 0 comments - [Report: Open Source Malware Instances Increased 73% in 2025](https://daily.dev/posts/report-open-source-malware-instances-increased-73-in-2025-anf8wehah) · Security Boulevard · 1 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#cicd](https://daily.dev/tags/cicd), [#malware](https://daily.dev/tags/malware), [#github-actions](https://daily.dev/tags/github-actions), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/the-state-of-open-source-supply-chain-attacks-6n0c8tjb5) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The State of Open Source Supply Chain Attacks","url":"https://daily.dev/posts/the-state-of-open-source-supply-chain-attacks-6n0c8tjb5","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-state-of-open-source-supply-chain-attacks-6n0c8tjb5"},"datePublished":"2026-08-23T22:28:15.773Z","dateModified":"2026-09-13T21:23:59.670Z","description":"StepSecurity's threat intelligence team tracked 56 confirmed open source supply chain attacks between August 2025 and August 2026, roughly one every three days...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1c74599bd80232d587dd1f9b2c5652f3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1c74599bd80232d587dd1f9b2c5652f3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"StepSecurity","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"StepSecurity","logo":"https://media.daily.dev/image/upload/s--vegWii-S--/f_auto,q_auto/v1774959924/logos/stepsecurity?_a=BAMAMiWQ0","url":"https://daily.dev/sources/stepsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-state-of-open-source-supply-chain-attacks-6n0c8tjb5","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cicd,malware,github-actions,npm","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"StepSecurity","item":"https://daily.dev/sources/stepsecurity"},{"@type":"ListItem","position":3,"name":"The State of Open Source Supply Chain Attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-state-of-open-source-supply-chain-attacks-6n0c8tjb5#faq","mainEntity":[{"@type":"Question","name":"How many open source supply chain attacks happened between August 2025 and August 2026?","acceptedAnswer":{"@type":"Answer","text":"StepSecurity's threat intelligence team confirmed 56 distinct supply chain attacks across npm, PyPI, RubyGems, Composer, and crates.io during that period, each triggering a real-time alert with indicators of compromise. The rate rose sharply starting March 2026, from roughly one attack per month to about one every three days, with 13 incidents in March alone and 50 of the 56 total occurring after February 2026. Teams tracking supply chain risk trends can follow attack data and defenses like these on daily.dev."}},{"@type":"Question","name":"What was the Team PCP supply chain attack campaign in March 2026?","acceptedAnswer":{"@type":"Answer","text":"Team PCP ran a five-day campaign from March 19 to 24, 2026, compromising widely trusted components including the Trivy GitHub Action (76 of 77 version tags), the Checkmarx KICS Action, the telnyx PyPI package, and LiteLLM, then harvesting CI/CD credentials from memory. The campaign stole 78,330 secrets from 2,186 organizations, including 92 public companies worth a combined $6.2 trillion. Developers assessing CI/CD credential exposure can keep up with campaigns like this via daily.dev."}},{"@type":"Question","name":"How does the Shai-Hulud npm worm spread and why is it dangerous?","acceptedAnswer":{"@type":"Answer","text":"Shai-Hulud, first seen in September 2025, compromised over 500 npm packages by stealing each victim's npm token and using it to automatically infect every package that maintainer published, making it the first supply chain attack to self-propagate at ecosystem scale. Variants followed, including Sha1-Hulud in November 2025 hitting Zapier and ENS Domains, and mini variants targeting SAP and TanStack packages in 2026. Developers guarding against self-propagating npm worms can track new variants and mitigations on daily.dev."}}]} ```