Google Warns Open Source Supply Chain Attacks Are Rising, Urges Stronger Software Defenses

Open Source Supply Chain Attacks Surge as Threat Actors Weaponize Developer Ecosystems

Software supply chains have become one of the most attractive targets for modern threat actors. Instead of attacking organizations directly, attackers increasingly compromise the software components, developer tools, and open source packages that businesses already trust.

Google Threat Intelligence Group (GTIG) and Mandiant have warned that open source software supply chain compromises expanded significantly during 2025 and the first half of 2026. The organizations observed a growing number of campaigns targeting package repositories, development environments, and software dependencies used across enterprise applications.

Historically, the cybersecurity community has focused heavily on high-profile software supply chain attacks such as the 2020 SolarWinds compromise and the 2023 3CX incident. These attacks demonstrated how compromising trusted software providers could provide attackers with access to thousands of downstream organizations.

However, GTIG’s latest analysis highlights a major shift. Threat actors are increasingly moving toward open source ecosystems because they provide attackers with speed, scale, and lower operational barriers.

Open source packages are downloaded millions of times, often automatically integrated into applications, and deeply embedded into modern development workflows. A single compromised dependency can therefore become a gateway into thousands of organizations.

According to GTIG, large-scale campaigns involving malicious packages, automated propagation techniques, and repeated compromises represent a significant expansion of this threat category. The company expects attackers to continue adopting these techniques throughout 2026 and beyond.

The message for enterprises is clear: software supply chain security can no longer be treated as a developer-only concern. It has become a core cybersecurity responsibility involving security teams, engineering leaders, cloud operators, and business executives.

Key Developments: Open Source Ecosystems Become Prime Attack Targets

GTIG and Mandiant identified that many of the most impactful software supply chain incidents in 2025 and early 2026 involved compromises of:

• Open source code repositories

• Software dependencies

• Package registries

• Developer tools

• CI/CD pipelines

These attacks fall under the MITRE ATT&CK technique T1195.001: Compromise Software Dependencies and Tools.

Unlike traditional software supply chain attacks, open source compromises often require fewer resources. Attackers do not always need to breach a major software vendor. Instead, they can target:

• Individual package maintainers

• Developer accounts

• Repository workflows

• Build automation systems

• Popular dependencies

Once successful, malicious code can spread through legitimate software distribution channels.

UNC6780 Campaign Targets npm, PyPI, and Docker Ecosystems

One of the most significant campaigns tracked by GTIG involved threat actor UNC6780, also known as TeamPCP.

Between February and May 2026, UNC6780 conducted extensive open source supply chain compromises targeting ecosystems including:

• npm

• PyPI

• Docker Hub

The attacker used multiple initial access methods, including abuse of the GitHub Actions pull_request_target workflow trigger.

This workflow feature is designed to allow automation on pull requests from external contributors. However, if incorrectly configured, it can expose repository secrets and write permissions.

UNC6780 used compromised packages to deploy credential-stealing malware, including SANDCLOCK, designed to collect valuable authentication data.

During incident response investigations, Mandiant observed attempts to move from compromised artificial intelligence software environments into broader enterprise networks.

The stolen credentials were reportedly monetized through direct sales or partnerships with ransomware and extortion groups.

This demonstrates how supply chain compromises can become the starting point for larger intrusion campaigns.

axios npm Package Compromise Highlights Dependency Risk

Another major incident involved the compromise of the widely used axios npm package in March 2026.

According to GTIG analysis and maintainer investigation, attackers compromised a maintainer account through social engineering and used that access to publish malicious package versions.

The malicious update included a dropper that deployed the WAVESHAPER.V2 backdoor.

Although the malicious versions were removed from the npm registry within approximately three hours, the potential impact was significant.

The axios package has more than 100 million weekly downloads and is used as a dependency by tens of thousands of other packages.

GTIG supported affected organizations across:

• 15 industry sectors

• 13 countries

The incident demonstrates the cascading impact of dependency-based attacks. A single compromised package can affect organizations that never directly installed the malicious code intentionally.

AI Expected to Accelerate Software Supply Chain Threats

Artificial intelligence is becoming a major factor in the evolution of software supply chain attacks.

GTIG expects AI adoption in software development to increase attacker opportunities in several ways.

Modern development practices increasingly involve AI-assisted coding tools, automated agents, and AI-powered workflows. While these technologies improve productivity, they also introduce new security risks.

Threat actors can use AI to accelerate malicious code generation, identify vulnerable packages, automate reconnaissance, create more convincing social engineering campaigns, and scale package poisoning operations.

GTIG highlighted concerns around AI coding environments, particularly emerging workflows sometimes described as “vibe coding,” where developers rely heavily on AI-generated code.

Attackers have already attempted to manipulate AI ecosystems by:

• Planting malicious resources in AI communities

• Publishing malicious Model Context Protocol (MCP) packages

• Creating packages designed to influence AI coding agents

In one reported case, a malicious cryptocurrency-themed package was uploaded by North Korean threat actors. An AI coding agent later incorporated the package into a legitimate project dependency.

This represents a new security challenge: AI systems can unintentionally become distribution channels for compromised software components.

Thousands of Malicious Packages Discovered Across Open Source Ecosystems

The increase in malicious packages is not limited to individual campaigns.

GTIG’s observations align with statistics from the Open Source Security Foundation (OpenSSF), which reported a significant increase in detected malicious open source packages between 2024 and 2025.

The growth highlights an important trend: attackers are increasingly treating open source repositories as operational environments rather than simple targets.

Open source ecosystems provide attackers with global distribution, developer trust, automated installation processes, limited manual review, and rapid downstream adoption, making them attractive channels for large-scale campaigns.

For attackers, compromising a package can provide access to many organizations simultaneously.

For defenders, this means traditional vulnerability management approaches are insufficient.

Organizations must understand:

• Which dependencies they use

• Where those dependencies are deployed

• Who maintains them

• How they enter production environments

Mitigation Guidance for Software Supply Chain Security

Software supply chain security requires multiple defensive layers. No single security control can prevent every compromise.

GTIG and Mandiant recommend organizations adopt a combination of governance, identity protection, secure development practices, and continuous monitoring.

Software Bill of Materials (SBOM) and Dependency Visibility

A Software Bill of Materials provides an inventory of software components used inside applications.

SBOM adoption enables organizations to:

• Identify affected dependencies quickly

• Track vulnerable components

• Understand software ownership

• Respond faster during supply chain incidents

However, organizations should move beyond basic inventory.

GTIG recommends maintaining an Action Bill of Materials (ABOM), which tracks:

• Third-party pipeline vendors

• Development utilities

• Build tools

• Container image dependencies

This provides visibility into the complete software creation process.

Strengthening CI/CD Pipeline Security

Modern software pipelines have become high-value targets.

Attackers increasingly target:

• Build automation

• Repository permissions

• Workflow configurations

• Developer credentials

Organizations should strengthen CI/CD security by adopting ephemeral runners, reducing persistent build environments, restricting privileged workflow triggers, reviewing GitHub Actions permissions, and monitoring unauthorized workflow changes.

The abuse of GitHub Actions pull_request_target demonstrates why automation workflows require security governance.

Identity Security and Credential Protection

Compromised credentials remain one of the most effective paths for supply chain attacks.

Organizations should reduce dependence on:

• Long-lived API keys

• Static personal access tokens

• Shared administrative credentials

Recommended approaches include:

• Short-lived tokens

• Federated identity systems

• OpenID Connect authentication

• Hardware-backed security keys

• Strong multi-factor authentication

The goal is simple: stolen credentials should expire quickly and provide limited access.

Securing Package Installation Workflows

Package managers represent another critical security layer.

Organizations should implement:

• Dependency approval processes

• Internal package repositories

• Package quarantine periods

• Automated vulnerability scanning

• Installation script restrictions

For example:

• npm environments should disable unnecessary lifecycle scripts

• Python environments should use trusted internal package indexes

• New dependencies should be reviewed before production use

These controls reduce the chance that malicious packages execute automatically.

Industry Impact: Why Software Supply Chain Security Is Now a Business Priority

The rise of open source supply chain compromises changes how organizations must think about cybersecurity risk.

Previously, many security teams focused primarily on protecting internal infrastructure, endpoints, and networks. However, modern enterprises increasingly depend on external software components that they do not directly control.

Applications today are built using thousands of third-party libraries, cloud services, containers, APIs, and developer tools. This interconnected model improves innovation speed but creates a larger attack surface.

A vulnerability or compromise in a single dependency can create risks across multiple business functions.

Impact on Enterprise Security Teams

Security teams face a growing challenge: identifying malicious activity before compromised software reaches production environments.

Unlike traditional vulnerability management challenges, supply chain attacks often involve newly created malicious packages, compromised trusted accounts, legitimate software versions containing malicious code, dependency hijacking, and build pipeline manipulation.

This means security teams must expand from vulnerability detection toward software provenance and behavioral monitoring.

Organizations need visibility into:

• Who publishes software components

• How dependencies enter applications

• Whether build processes have been modified

• Which production systems rely on affected packages

Security operations centers (SOCs) will increasingly need to monitor software development environments alongside traditional enterprise infrastructure.

Impact on Developers and Engineering Teams

Developers are now directly involved in cybersecurity defense.

Modern engineering teams must balance speed with security without creating unnecessary friction.

Open source dependencies enable rapid development, but developers must consider:

• Package reputation

• Maintainer security practices

• Dependency lifecycle

• Installation behavior

• Repository activity

Security practices such as dependency review, code signing validation, and secure package management must become part of normal development workflows.

The future of secure development will require collaboration between:

• Developers

• Security engineers

• Platform teams

• DevOps teams

• Compliance leaders

Security cannot be added after software is built. It must be integrated into the software lifecycle.

Impact on Cloud and AI Environments

Cloud-native development has increased dependence on automated software pipelines.

Organizations now operate through interconnected systems including:

• Cloud infrastructure

• Container platforms

• Infrastructure-as-code tools

• AI development environments

• Automated deployment pipelines

A compromised dependency can potentially provide attackers with access to cloud credentials, deployment systems, or sensitive data.

The growing adoption of AI development tools introduces additional concerns.

AI systems frequently consume:

• Open source models

• Libraries

• Plugins

• MCP packages

• External datasets

As AI becomes embedded into enterprise workflows, securing AI software supply chains will become as important as securing traditional application dependencies.

Why This Matters: The Software Trust Model Is Changing

The software industry has traditionally operated on a trust assumption:

If software comes from a popular repository or trusted developer account, it is probably safe.

Supply chain attacks challenge this assumption.

Attackers are increasingly targeting trust relationships rather than technical vulnerabilities alone.

A malicious package may not exploit a software flaw. Instead, it abuses:

• Developer trust

• Automated installation processes

• Repository permissions

• Weak identity controls

• Poor dependency visibility

This represents a major shift in cybersecurity.

The question organizations must ask is no longer:

“Is this software vulnerable?”

The more important question is:

“Can we verify that this software is what we intended to install?”

This is where concepts such as software provenance, cryptographic verification, SBOMs, and secure build pipelines become critical.

Challenges and Considerations

Although stronger supply chain security practices can significantly reduce risk, organizations face several adoption challenges.

1. Dependency Complexity

Large applications may contain thousands of dependencies, making manual management impossible. Organizations need continuous inventory, automated scanning, ownership tracking, and risk prioritization to understand their software ecosystem.

2. Balancing Security and Developer Productivity

Security controls can create friction if poorly implemented.

For example:

• Excessive approval requirements may slow development

• Strict restrictions may encourage workarounds

• Complex security processes may reduce adoption

The goal should be secure-by-default development workflows rather than security barriers.

Examples include:

• Automated dependency scanning

• Pre-approved repositories

• Secure development templates

• Developer-friendly security tools

3. Third-Party Visibility Limitations

Organizations often depend on vendors they cannot fully control.

Challenges include:

• Limited transparency into vendor development practices

• Incomplete software inventories

• Unknown fourth-party dependencies

Vendor risk management must evolve beyond compliance questionnaires.

Organizations need continuous evaluation of external software relationships.

4. AI Introduces New Supply Chain Risks

AI-assisted development creates new attack possibilities.

Potential risks include:

• Malicious AI-generated code

• Poisoned training resources

• Unsafe AI plugins

• Compromised AI agent dependencies

Organizations must extend software supply chain security principles into AI development environments.

Future Outlook: The Next Phase of Software Supply Chain Security

The software supply chain threat landscape is expected to continue evolving.

Several trends are likely to shape cybersecurity strategies in the coming years.

Greater Adoption of Software Provenance

Organizations will increasingly require proof that software components:

• Came from trusted sources

• Were built securely

• Were not modified during distribution

Technologies supporting:

• Digital signatures

• Cryptographic attestations

• Secure build systems

will become standard components of enterprise software security.

AI-Powered Security Validation

AI will likely become part of both attack and defense strategies.

Security teams may increasingly use AI systems to:

• Analyze dependencies

• Detect suspicious package behavior

• Identify abnormal developer activity

• Simulate attack chains

• Generate remediation recommendations

However, AI security systems themselves will require strong governance.

Stronger Package Ecosystem Controls

Package repositories and development platforms are expected to introduce more built-in security protections.

Future improvements may include:

• Automated malicious package detection

• Stronger maintainer identity verification

• Improved dependency reputation scoring

• Mandatory security metadata

The industry is moving toward a model where software trust must be continuously verified.

Software Supply Chain Security Becomes Part of Enterprise Resilience

Supply chain security is no longer only a technical issue.

It directly affects:

• Business continuity

• Customer trust

• Regulatory compliance

• Operational resilience

Organizations that build mature software security practices will be better positioned to adopt cloud technologies, AI platforms, and modern development approaches safely.

Conclusion

The latest analysis from Google Threat Intelligence Group and Mandiant highlights a fundamental change in the cybersecurity landscape.

Attackers are increasingly targeting the software ecosystems organizations depend on, with open source packages becoming a preferred avenue for large-scale compromise.

The growth of campaigns targeting npm, PyPI, Docker ecosystems, and developer workflows demonstrates that software trust must be actively managed.

Organizations cannot rely only on traditional vulnerability scanning. They need a comprehensive strategy combining:

• Software inventories

• SBOM and ABOM management

• Secure CI/CD pipelines

• Strong identity controls

• Package verification

• Continuous monitoring

• Incident response preparation

As AI accelerates software development, securing the software supply chain will become even more important. Google's guidance emphasizes that organizations should strengthen identity security, secure CI/CD pipelines, improve software provenance, continuously monitor dependencies, and adopt layered verification practices to reduce the risk of software supply chain compromise.