From Shai-Hulud to the leaked Miasma source code — here's how adversaries are exploiting trusted developer workflows.
Security teams have spent years preparing for operational supply chain compromise, where a breached vendor, managed service provider, or software-as-a-service platform becomes a pathway into downstream organizations. That risk remains, but threat actors are increasingly going up the chain, infiltrating the systems and workflows developers use to build and ship software in the first place.
These software supply chain attacks now target packages, maintainer accounts, repositories, developer tools, CI/CD pipelines, and publishing credentials. The target isn't just the software an enterprise runs — it's the trusted process that builds and releases it. That shift has opened up a much larger attack surface that's proven difficult to defend.
Targeting how software is built
Our new report, Poisoned Trust: How Supply Chain Attacks Weaponize Developer Ecosystems, focuses on software supply chain compromise, which exploits the people, tools, and systems involved in building and releasing software — leveraging the speed and automation of modern development processes for scale and impact.
In software supply chain campaigns, the primary goal is often the theft of credentials and secrets, which can be monetized directly or used to compromise more of the pipeline. The initial foothold might be a maintainer account, a publishing token, a CI/CD runner, a repository, or a developer extension.
These attacks proliferate because modern developer environments are so interconnected. A single workstation or CI/CD runner can hold source code, package-publishing permissions, GitHub or GitLab credentials, cloud keys, deployment secrets, private repo tokens, OAuth tokens, and more. Once an attacker has that, they can pivot into more packages, repositories, build systems, cloud environments, or downstream organizations.
From Shai-Hulud to TeamPCP: two campaign timelines
Intel 471 research shows attacker tradecraft targeting the software production chain has advanced substantially since the first Shai-Hulud campaign in September 2025 — which targeted primarily node package manager (npm) packages — through the cluster of multi-ecosystem attacks that the threat group TeamPCP conducted before May 2026 (see timeline below). TeamPCP, which emerged in November 2025, quickly became one of the most active and effective publicly reported threat groups targeting software supply chains.
A timeline of Shai-Hulud-related events from Sept. 14, 2025, to May 31, 2026.
Shai-Hulud and Shai-Hulud 2.0 were early examples of worm-driven campaigns, pairing credential theft with self-propagation across trusted software ecosystems. Related and copycat activity since then — Mini Shai-Hulud, and campaigns branded Miasma, Hades, IronWorm, and GlassWorm — shows how the same propagation logic keeps getting adapted across package registries, repositories, IDE marketplaces, and developer environments.
Complicating defense further, on May 13, 2026, TeamPCP published Shai-Hulud as an open-source attack tool on GitHub, alongside a forum contest offering roughly $1,000 in Monero for the largest package compromise. Then on June 9, 2026, an actor released Miasma's source code, extending TeamPCP's leaked codebase into a multi-ecosystem framework for targeting npm, PyPI, RubyGems, and JFrog Artifactory.
An overview of TeamPCP-related campaigns reported from November 2025 through May 2026.
Releasing that source likely served both operational and psychological purposes: it raises the odds of copycat campaigns, complicates attribution, and keeps the toolkit useful even after the original campaign's repos, credentials, and package versions are pulled by maintainers. It's a signal to affected organizations that cleaning up the original incident won't stop others from picking up the same tool.
That said, our analysts don’t expect an avalanche of copycats. Public code lowers the barrier to entry, but we assess that using these toolkits effectively still takes significant operational knowledge of package-publishing workflows, CI/CD trust relationships, credential exposure paths, automation logic, and victim selection. That skill set is more likely to show up among financially motivated intrusion clusters, access brokers, ransomware-adjacent actors, and state-linked groups than opportunistic copycats.
Hunt packages for defenders
The report also gives analysts leads to hunt for behaviors associated with campaigns detailed in the report. It maps out two HUNTER hunt package collections: Shai-Hulud Worm 2.0 activity and a collection for TeamPCP's supply chain attacks. This allows Verity471 HUNTER subscribers to pivot straight into the relevant hunts from the report. The Shai-Hulud collection covers detections like PowerShell and curl/wget-based downloads, Node spawning the Bun runtime during npm lifecycle events, privileged Docker containers mounting host filesystems, disk-wipe activity, and secret-scanning tools like TruffleHog. The TeamPCP collection focuses on Node.js invoking systemctl for persistence, bulk kubectl secret dumps, Python running from non-standard directories, and cloud metadata service probing.
Want the full picture — attacker methods, campaign timelines, and the defensive playbook?
Download the full Intel 471 report, Poisoned Trust: Review of Notable Software Supply Chain Attacks from September 2025 to June 2026, and get ahead of the next campaign before it reaches your pipeline.