Google Threat Intelligence Group (GTIG) and Mandiant detail a significant rise in open source software supply chain compromises during 2025 and early 2026, contrasting this with traditional supply chain compromise which remains rare.

The post identifies multiple large-scale campaigns, including UNC6780 (TeamPCP) compromising PyPI, npm, and Docker Hub from February to May 2026, often abusing the pull_request_target GitHub Actions trigger to deploy credential stealers like SANDCLOCK.

Another notable incident was the March 2026 compromise of the axios npm package via social engineering of the maintainer account, leading to the WAVESHAPER.

V2 backdoor affecting at least 15 verticals and 13 countries.

GTIG assesses that open source supply chain compromises offer attackers efficiency and scale with less planning than traditional attacks, though they are noisier and detected more quickly.

The blog post highlights that AI is likely to accelerate this trend, as ‘vibe coding’ and AI coding agents unwittingly incorporate malicious packages, and threat actors plant malicious MCP packages.

OpenSSF data corroborates a 1,444% increase in malicious open source packages from 2024 to 2025. In contrast, traditional supply chain compromises (T1195.

002) remain rare, with notable exceptions being the $1.4B cryptocurrency theft via UNC4899, the Notepad++ hosting infrastructure compromise (UNC6688), and the DAEMON Tools installer attack (UNC6863).

The bulk of the post provides extensive mitigation recommendations organized into administrative oversight (SBOM, ABOM, SDLC threat modeling with Wiz SITF), vendor lifecycle management, security architecture (OIDC, token expiration, FIDO2 SSH, ephemeral runners), infrastructure protection (zero trust, micro-segmentation), and continuous verification (automated SBOM management, OSV-Scanner, quarantine gates).

Specific technical controls include enforcing npm minimumReleaseAge (24h cooldown), disabling package install scripts via ignore-scripts, auditing maintainer email domains, and integrating with native platform guardrails like Dependabot cooldowns (July 2026) and PyPI server-side immutability (July 2026).

The post references Google’s Assured Open Source Software, OSV-Scanner, and the publicly available Wiz SDLC Infrastructure Threat Framework (SITF) as tools to harden the software supply chain.