Google Warns of Escalating Open-Source Supply Chain Attacks
Google's threat intelligence division forecasts a significant increase in open-source supply chain compromises, citing ease of scale and replication as key drivers for threat actors.
Computing giant Google has issued a stark warning regarding the escalating threat posed by open-source supply chain attacks, asserting that these compromises are becoming increasingly lucrative and easier to scale than traditional methods. The company's Threat Intelligence Group (GTIG) assesses with high confidence that the proliferation of large-scale campaigns, including those employing worms and iterative compromises observed in 2025 and early 2026, represents a substantial expansion in the use of this tactic. This trend is expected to continue, with threat actors likely to emulate successful strategies and contribute to further growth throughout 2026 and beyond.
These attacks leverage the inherent interconnectedness of the open-source ecosystem, targeting code repositories, software dependencies, and developer tools. Google highlighted the alarming reach of campaigns such as TeamPCP's Shai-Hulud malware, which affected an estimated 20 million weekly downloads of open-source software in its initial wave and expanded to encompass packages with 100 million weekly downloads in a subsequent campaign. This demonstrates the rapid and widespread impact that a single compromised component can have across the global software development landscape.
The integration of artificial intelligence (AI) functionalities into open-source projects is also creating new avenues for exploitation. Google notes that AI can accelerate software compromises by providing attackers with new vectors to manipulate, while simultaneously enabling threat actors to use AI to speed up and scale their own operational planning. This symbiotic relationship between AI and open-source development presents a complex challenge for security professionals.
Several high-profile incidents underscore Google's concerns. A North Korean threat actor, identified as Midnight Neptune, successfully compromised the maintainer account of the widely used axios JavaScript package through social engineering. Malicious updates were published, and although quickly removed from the npm registry, the package's extensive reach—over 100 million weekly downloads—meant that at least 15 industries across 13 countries were potentially affected. The axios package's role as a dependency for tens of thousands of other packages further amplified the potential for malicious code propagation across the JavaScript ecosystem.
Another significant campaign by TeamPCP (also tracked as UNC6780) involved poisoning trusted packages and exploiting vulnerabilities in developer tools. This campaign led to the theft of approximately 3,800 internal GitHub repositories via a compromised VS Code extension and attacks on GitHub Actions associated with popular tools like the Trivy vulnerability scanner and the AI integration tool LiteLLM. Attackers utilized compromised PyPI packages and malicious pull requests to gain access, subsequently deploying the Sandclock credential stealer to exfiltrate cloud secrets such as AWS keys and GitHub tokens.
The compromise of AI software used by multiple Large Language Model (LLM) providers expanded the attack surface, leading to considerable exposure of AI API secrets. This allowed for further intrusions and potential misuse of sensitive AI functionalities. For instance, malicious code was injected into Hugging Face's Open-OSS/privacy-filter repository, accumulating 200,000 downloads. In another instance, a malicious npm package impersonating a legitimate server secretly forwarded sensitive information from outgoing emails to an attacker.
Nation-state actors are also exploiting vulnerable coding agents. A North Korea-linked group, Famous Chollima, reportedly tricked an AI coding agent into adding a malicious package as a dependency to a cryptocurrency trading project. This package, disguised as a routine validation tool, was designed to steal users' cryptocurrency funds by accessing their wallets. Statistics compiled by the Open Source Security Foundation (OpenSSF) corroborate these findings, indicating a staggering 1,444% increase in identified malicious open-source software packages between 2024 and 2025, highlighting the urgent need for enhanced security measures across the open-source supply chain.