npm Supply Chain Security

TeamPCP turned supply-chain attacks into a near-weekly flywheel: poison dev tools, steal tokens from maintainer machines, publish the next wave. Mini Shai-Hulud automates that loop. Registry quarantine helps; protecting the endpoint and rotating long-lived credentials is what stops exfiltration after a bad install.

Who is TeamPCP?

TeamPCP (also DeadCatx3, PCPcat, ShellForce, CipherForce) is a financially motivated group that escalated from cloud misconfigurations and Next.js exploits (late 2025) into the longest-running open-source supply chain spree on record. Source: WIRED, 2026-05-21

Core tactic (flywheel): Compromise a tool developers use (VSCode extension, npm package, PyPI lib) → postinstall/import malware runs on maintainer and downstream machines → steal npm/GitHub/cloud tokens → publish malicious versions of other tools → repeat. Wiz describes it as a "flywheel of supply chain compromises." Source: WIRED, 2026-05-21

Scale (Socket): 20+ attack waves in recent months; 500+ distinct software packages poisoned (1,000+ counting versions). Source: WIRED, 2026-05-21

Notable victims: GitHub (~3,800 internal repos via poisoned VSCode extension; source offered for sale on BreachForums), Mercor, OpenAI (two employee devices via TanStack wave), European Commission public site (Trivy chain), plus hundreds of orgs that installed tainted packages. Source: WIRED, 2026-05-21

Mini Shai-Hulud: Self-spreading worm naming Dune-themed GitHub repos ("A Mini Shai-Hulud Has Appeared") with encrypted stolen creds. Distinct from but named after the September 2025 Shai-Hulud worm (no confirmed TeamPCP link to that earlier campaign). Source: WIRED, 2026-05-21

Motivation: Ransomware/data extortion, credential sales, publicity (taunts, BreachForums ads). RaaS ties to BreachForums and DragonForce since April 2026. Source: WIRED, 2026-05-21

Machine-first defense (why code review is not enough)

Payloads execute on your machine at npm install, pip install, or Python import. They harvest filesystem paths for secrets (~90–130 paths in recent waves): AWS/Azure/GCP creds, SSH keys, kubeconfig, .env, GitHub/GitLab PATs, npm tokens, AI API keys, Vault, wallets. The stolen asset is credentials, not your application source. A clean repo does not help if ~/.aws/credentials is readable from a postinstall script.

Socket's Philipp Burckhardt: "At the point it hits your machine, it's already too late." Source: WIRED, 2026-05-21

Palo Alto's Nathaniel Quist: success is driven by long-lived credentials in dev environments; rotate GitHub/GitLab PATs, cloud keys, and tokens even if you did not install a known-bad package. Source: WIRED, 2026-05-21

Layered model:

The registry-quarantine knob is package-manager specific. npm's current config docs list min-release-age, but this local repo is running npm 11.8.0, which warns that the project min-release-age config is unknown; do not count that setting as enforced unless the runner's npm version supports it. pnpm documents minimumReleaseAge in minutes, added in 10.16.0, with a built-in non-strict one-day default in pnpm 11 and strict behavior when a project explicitly sets the value. Source: npm config docs, 2026-07-04; Source: pnpm supply-chain docs, 2026-07-04; Source: local npm --version, 2026-07-04

Tooling Adoption Signal

Nub is a 2026 example of package tooling adopting this page's defense model as a default: release-age quarantine, OSV checks during dependency resolution, blocked untrusted postinstall scripts, and provenance trust-downgrade checks. That matters because install-time defense is most useful when it is in the normal package manager path, not a separate reminder an agent has to remember after the risky command already ran. Source: X/@colinhacks launch thread, 2026-06-17

Treat this as an evaluation signal, not an adoption order. For Kevin projects, Nub still needs repo-local tests for lockfile round-tripping, workspace behavior, and legitimate postinstall exceptions before replacing existing package-manager flows.

The Shai-Hulud Campaign (March-May 2026)

Timeline of major waves attributed to TeamPCP (overlaps with flywheel above). Source: compiled from Snyk, SecurityWeek, Phoenix Security, Bleeping Computer, StepSecurity, Palo Alto Unit42, Datadog Security Labs, WIRED, 2026-05-22

Wave 1: Trivy (March 2026)

Aqua Security's Trivy vulnerability scanner was compromised. A security scanner shipping malware. CVE-2026-33634, CVSS 9.4 (NVD / StepSecurity). Source: NVD CVE-2026-33634; Source: StepSecurity, 2026-03

Wave 2: Bitwarden CLI (April 22, 2026)

Malicious @bitwarden/cli@2026.4.0 published at 21:57 UTC, deprecated at 23:30 UTC. 93-minute window. First documented npm attack using Trusted Publishing (OIDC). Payload included credential harvesting, self-propagating worm, GitHub Actions workflow injection, and AI assistant poisoning. CVE pending (Bitwarden confirmed issuance; no CVSS at disclosure). Source: Phoenix Security, 2026-04-22

Wave 3: SAP + PyTorch Lightning (April 29, 2026)

373 malicious versions across 169 packages. SAP CAP ecosystem (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service, mbt) and PyTorch Lightning on PyPI. Payload featured AI coding agent persistence (.claude/settings.json), encrypted exfiltration, Russian locale exemption. No CVE assigned. Source: ProbablyPwned, 2026-04-29; Source: Lyrie Research, 2026

Wave 4: Mini Shai-Hulud / TanStack (May 11, 2026)

The largest single wave. 84 malicious versions across 42 @tanstack packages published in 6 minutes (19:20-19:26 UTC). Attack chain: pull_request_target GitHub Actions misconfiguration → cache poisoning across fork-to-base boundaries → OIDC token extraction from Actions runner process memory. Source: SecurityWeek, 2026-05-12

Same wave also hit: OpenSearch JS client (@opensearch-project/opensearch versions 3.5.3, 3.6.2, 3.7.0, 3.8.0; 1.3M weekly downloads), Mistral AI SDK (mistralai 2.4.6 on PyPI), 65 UiPath packages, additional @squawk/* packages on npm, Guardrails AI (guardrails-ai 0.10.1 on PyPI), and 12+ other namespaces. Source: Snyk, 2026-05-12; Source: X community report, 2026-05-11

guardrails-ai 0.10.1 (PyPI): Malicious code runs on import. On Linux it downloads git-tanstack[.]com/transformers.pyz, writes to /tmp/transformers.pyz, and executes with python3 without integrity checks. The domain displayed a message signed "With Love TeamPCP" claiming ongoing credential theft. Source: X community report, 2026-05-11

Why unprecedented: First npm worm with valid SLSA Build Level 3 provenance and legitimate Sigstore signatures. The build pipeline itself was hijacked, so Sigstore correctly verified the malicious build. Provenance alone is no longer a trust signal. CVE-2026-45321, CVSS 9.6. Source: Phoenix Security, 2026-05-12

Wave 5: node-ipc (May 14, 2026)

Malicious versions 9.1.6, 9.2.3, and 12.0.1 of node-ipc (500K weekly downloads). Obfuscated credential stealer in the CJS entrypoint. Harvests ~90 file paths (AWS, Azure, GCP, SSH keys, Kubernetes configs, GitHub tokens, AI API keys). Exfiltrates via DNS TXT queries to a typosquatted Microsoft domain (sh.azurestaticprovider.net). Likely vector: compromised maintainer account via re-registered expired email domain. No CVE assigned at publication. Source: Datadog Security Labs, 2026-05-14

Wave 6: @antv Ecosystem (May 19, 2026)

600+ malicious packages across 323 unique packages in Alibaba's AntV data visualization ecosystem. @antv/g2, @antv/g6, @antv/l7, @antv/s2, echarts-for-react (1.1M weekly downloads). Compromised via the atool maintainer account. Exfiltrated tokens used to create 2,200+ GitHub repositories named with Dune-universe terminology. Credentials harvested from 130+ file paths including cloud, Kubernetes, HashiCorp Vault, and cryptocurrency wallets. No CVE assigned. Source: StepSecurity, 2026-05-19

Shared Malware Capabilities (All Waves)

All payloads share: credential and API key theft, self-propagation through stolen CI tokens, persistence in .claude/ directories and .vscode/tasks.json (survives npm uninstall), exfiltration via Session P2P encrypted messaging or DNS tunneling. Later waves added AI assistant poisoning and valid provenance attestations. Source: compiled from all sources

Historical Attacks (pre-2026)

Defense Checklist

Machine and credentials (first)

• Assume any recent npm/pip install on a dev machine may have run malware; rotate all high-value tokens (GitHub, GitLab, npm, AWS, Azure, GCP, SSH, AI APIs) not only packages you recognize
• Use Brin - Agent Context Security or equivalent to block installs before scripts run
• After suspected compromise: remove .claude/ poisoned settings, .vscode/tasks.json persistence, audit CI workflows injected via stolen tokens
• Prefer short-lived OIDC over long-lived PATs where possible

Dependency Governance

• Audit all dependencies: are they really needed?
• Use npm ci in CI (deterministic installs from lockfile only)
• Host your own dependency registry (Verdaccio, Artifactory, GitHub Packages)
• Use npm min-release-age=7 only on npm versions that recognize it; otherwise the warning means the quarantine is not proof
• In pnpm, set minimumReleaseAge: 10080 in pnpm-workspace.yaml or pnpm config (7 days in minutes)
• Lockfile is mandatory; changes only through code review
• Add npm audit, Dependabot, and Dependency Review to PR checks

CI/CD Hardening

• Review npm scripts: postinstall, prepare, preinstall can execute arbitrary code
• Enable 2FA for GitHub, GitLab, npm, and cloud accounts
• Enable secret scanning and push protection
• Protect main/release branches: required reviews, no force push
• Limit Actions/CI permissions to minimal (read-only by default)
• Do not publish from CI (use manual publish with 2FA)
• Do not grant secrets to PRs from forked repos
• Deploy only from protected branches/tags

Backup and Recovery

• Enable backups and regularly test restore
• Pin dependency versions, review all version bumps

AI-Specific

• AI-generated code goes through the same review/tests/scans as human code
• AI tools do not receive prod secrets or write access
• Use Brin - Agent Context Security to pre-scan every npm/pip/cargo install for malware

---

Timeline

• 2026-07-04 | Deep-reviewed Timur Shemsedinov's text-only supply-chain checklist and tightened the release-age guidance: audit dependency necessity, use lockfile-only CI, prefer private registries when appropriate, and verify that npm/pnpm actually enforces the release-age gate in the runner version. Source: X/@tshemsedinov, 2026-05-18; Source: npm/pnpm docs, 2026-07-04
• 2026-05-22 | TeamPCP profile, machine-first defense, credential-rotation thesis; Wired GitHub/Mercor/OpenAI flywheel sourcing. Source: WIRED, 2026-05-21
• 2026-06-30 | Added Nub as a tooling-adoption signal for registry quarantine, OSV checks, blocked untrusted postinstall scripts, and provenance trust-downgrade checks. Source: X/@colinhacks, 2026-06-17
• 2026-05-22 | Added pinned OpenSearch versions, mistralai/guardrails-ai PyPI pins, guardrails import-time git-tanstack payload, ongoing spread note. Source: User, 2026-05-22
• 2026-05-19 | Full rewrite with 2-month timeline (6 waves: Trivy, Bitwarden CLI, SAP/PyTorch, TanStack/Mini Shai-Hulud, node-ipc, @antv). Compiled from Snyk, SecurityWeek, Phoenix Security, Bleeping Computer, StepSecurity, Palo Alto Unit42, Datadog Security Labs, ProbablyPwned, Chainguard, TanStack postmortem. Source: User + web research, 2026-05-19
• 2026-05-19 | Page created. Source: User + web research, 2026-05-19