2026 Supply Chain Attack Summary: Practical Defenses Learned from the Axios and LiteLLM Incidents

Four open-source projects compromised within two weeks

Between March 19 and March 31, 2026, in a span of just two weeks, a chain of supply chain attacks shook the open-source software ecosystem. In this campaign, dubbed the "TeamPCP Campaign" by security researchers, attackers pivoted laterally from GitHub Actions to PyPI to npm, compromising four major projects.

The Axios incident: A package with 100M weekly downloads poisoned for roughly three hours

What happened

On March 31, an Axios maintainer's npm account was hijacked, and two malicious versions were published within 39 minutes.

• Malicious dependency plain-crypto-js added to v1.14.1 and v0.30.4
• Cross-platform Remote Access Trojan (RAT) downloaded and executed via postinstall hook
• Detected and removed in roughly 2–3 hours, but projects that installed it during that window were potentially impacted

Google Threat Intelligence attributed this attack to the North Korea-nexus threat group UNC1069 (tracked by Microsoft as Sapphire Sleet).

Why it was dangerous

Axios is an HTTP client library that boasts roughly 100 million weekly downloads. Because postinstall scripts run automatically during npm install or CI/CD automated builds, malware was executed simply by installing the package.

The LiteLLM incident: Cascading attacks via CI/CD pipelines

Attack flow

The LiteLLM attack was a cascading compromise originating from the previously backdoored Trivy GitHub Action.

1. Backdoor injected into Trivy GitHub Action source code
2. PyPI credentials leaked because LiteLLM's CI/CD pipeline utilized Trivy
3. Attackers published malicious versions to PyPI using the exfiltrated credentials
4. Included a .pth file named litellm_init.pth, which executed automatically when Python processes started

When placed in Python's site-packages directory, .pth files are executed automatically without any explicit import call, making detection exceptionally difficult. A package with approximately 3.4 million daily downloads remained poisoned for about 40 minutes.

Critical conditions revealed by statistics

According to Sonatype's 2026 report, open-source supply chain attacks are expanding rapidly.

• Number of OSS malware packages: +75% YoY (cumulative total of 1.233 million)
• 454,648 new malicious packages detected in 2025 alone
• Total OSS downloads: 9.8 trillion/year (+67% YoY)
• 65% of CVEs in the NVD lack CVSS scores

Defenses to implement immediately

1. Hardening .npmrc

# postinstall等のライフサイクルスクリプトを無効化
# → Axiosの攻撃を直接防げた設定
ignore-scripts=true

# バージョン範囲ではなく固定バージョンで保存
save-exact=true

# 公開後7日未満のバージョンをブロック
# → 数時間の攻撃ウィンドウを完全排除
min-release-age=7

ignore-scripts=true is one of the most effective defensive measures. Disabling postinstall fundamentally blocks script execution attacks like the Axios incident.

2. Hardening CI/CD

• Always use npm ci: Only install versions locked in package-lock.json
• SHA-pin GitHub Actions: Pin actions to a commit SHA (@abc123...) rather than mutable tags (@v4)
• Require OIDC Trusted Publishers and mandatory 2FA for publishing to PyPI

# 危険な例
- uses: aquasecurity/trivy-action@latest

# 安全な例（SHAピニング）
- uses: aquasecurity/trivy-action@abc1234567890abcdef

3. Mitigations on the pip side

# ハッシュ検証を強制
pip install --require-hashes -r requirements.txt

# 既知の脆弱性をチェック
pip-audit

4. Implementing monitoring tools

• Socket.dev: Analyzes package behavior statically and dynamically to detect zero-day attacks not yet recorded in CVE databases
• npm audit signatures: Verifies signatures of npm packages
• Dependabot / Renovate: Mitigates the risk of lingering on legacy versions through automated dependency updates

Conclusion: The shift from trust to verification

The supply chain attacks of 2026 pose fundamental questions to the trust model of open-source software.

• npm install is not secure — Make ignore-scripts=true the default
• CI/CD pipelines serve as attack entry points — Pin external actions with commit SHAs
• Multi-hour attack windows exist — Buffer new releases using min-release-age

The era of blindly installing packages is over. These defensive measures can all be implemented with just a few lines in configuration files. Review your project's .npmrc today.

For broader website security practices, please also refer to our introductory guide to website security.