Software supply chain attacks are turning trusted developer tools into channels for credential theft and malware delivery.
Campaigns involving S1ngularity, Shai-Hulud, and TeamPCP show how compromised packages can expose developer workstations, build systems, and cloud infrastructure through routine software updates.
Rather than attacking each organization directly, criminals compromise software that many organizations already use. They steal publishing credentials, modify trusted components, and distribute malicious releases through established repositories.
Automated installation then carries the payload into downstream environments, expanding the impact of a single breach. The consequences extend beyond infected computers.
Australian authorities estimate that an alleged TeamPCP operation potentially compromised more than 1,000 organizations, enabled theft of over 500,000 credentials, and exfiltrated at least 300 gigabytes of data. Global remediation costs were estimated at hundreds of millions of dollars.
npm Updates Deliver Malware
The S1ngularity attack struck Nx on August 26, 2025. Attackers exploited a GitHub Actions injection weakness through a malicious pull request title. Unsanitized input executed shell commands inside a workflow with elevated repository permissions.
A stolen GitHub token allowed attackers to create a branch containing a malicious script and trigger a publishing workflow.
That script extracted the npm publishing token, which attackers then used to publish infected Nx packages outside the legitimate release pipeline. The malicious versions remained available for four hours.
Installation triggered postinstall scripts that searched affected systems for sensitive information. The payload also attempted to use local AI tools, including Claude and Gemini, to locate valuable files.
Stolen information was uploaded to public GitHub repositories using credentials available on victim machines. Shai-Hulud added another dangerous feature: self-propagation.
According to the supplied retrospective, the worm searched for npm publishing tokens and used them to push infected updates to additional packages. This turned credential theft into a repeating distribution cycle.
TeamPCP later demonstrated how compromises could cross ecosystems. ReversingLabs documented attacks involving Trivy, Checkmarx extensions, LiteLLM, and Telnyx.
Malicious LiteLLM versions 1.82.7 and 1.82.8 contained an information stealer targeting secrets in files and process memory.
The campaign illustrates cascading exposure: a compromised security tool running inside a build pipeline can reveal credentials used to publish another project.
Those credentials then enable further malicious releases, reaching users who never interacted with the initially compromised supplier.
Defenders should investigate affected installations as possible credential and host compromises, not merely dependency problems.
Recommended actions include isolating affected systems, removing malicious versions, checking for persistence, reviewing network activity, and rotating exposed tokens, keys, and secrets, ReversingLabs said.
Nx responded by replacing npm publishing tokens with OIDC-based Trusted Publishing, adding release approval requirements, and strengthening provenance checks.
These controls reduce reliance on reusable secrets while improving verification of package origins. Repository workflow permissions also need careful restriction.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
