Centriole Blog
Research and analysis on software supply chain security for security and engineering teams.
Featured
Featured post 1 of 5
Someone claimed the Quantix Finance npm scope before the real project did, published ten packages that steal credentials at install time, and hid the C2 address as an integer.
An operator published 0requests, py-0requests, py-1requests, and py-2equests to PyPI in 75.6 seconds. Import-time code tried to exfiltrate environment variables to localhost, and the same campaign system links the cluster to a May 2026 Telegram RAT.
Four unscoped packages named like Google Cloud internal tooling sat on npm for 129 days, published with three different dependency confusion version strategies, before npm replaced them with security placeholders.
Ten malicious versions of @7nohe/openapi-react-query-codegen were published in 21 minutes via a comment-triggered GitHub Actions workflow. The payload is a self-propagating worm across npm, RubyGems, and PyPI.
SCA and supply chain security share vocabulary. They do not share a threat model. Here is what each actually protects against in 2026.
2026 data shows TPRM and static SBOMs each cover half the problem. Here is what closes the remaining software supply chain gap.
A two-wave dependency confusion operation published 39 npm packages impersonating Raiffeisen, Tinkoff, and other Russian fintech internal modules, dropping a binary stage-2 loader on require().
On August 4, 2026, attackers compromised jaredwray's GitHub account and used it to publish a Shai-Hulud worm across 443+ npm packages, including keyv, cacheable, Deliveroo, and ServiceTitan scopes.
Three new NuGet packages flagged on July 21 mark the latest point in a 34-month campaign that evolved from PowerShell droppers to IL weaving and crypto wallet hijacking.
Six npm packages impersonating @whiskeysockets/baileys published 83 versions over 105 days. The campaign ends with a libsignal trojan that overwrites Baileys session files on disk.
The terminal3airport npm account republished 2.0.0 updates to 36 surviving adware packages on July 10, six weeks after npm removed 141 Scramjet proxy packages in May.
A 100+ gem RubyGems cluster published July 9 spans eight name prefixes. Epoch timestamps in gem names decode to May 12, 2026, linking wave 2 to the original GemStuffer event.
zod-pino, zod-pino434, and zod-pino444 are the third and fourth wave of a purpose-built cross-platform RAT that has been iterating on npm since April 2026, with OS-level persistence, full-disk crypto scanning, and C2 at 212.193.3.61 on AS206216.
A new npm package impersonates Adobe Sign's internal @adobesign scope at version 99.9.9, exfiltrating installer identity to a Burp Collaborator endpoint on every npm install.
A PyPI package that calls itself pkg-fallback, ships a module called string_kit, and fires an unconditional HTTP beacon to a bare IP at install time. One version, one victim window, one open question: what was the operator enumerating?
A single npm account published 18 empty stub packages over 25 days, each pulling a unique dropper tarball from a private Google Cloud Storage bucket that bypasses every npm registry scanner.
Four independent waves across 46 months. Eight malicious packages. One shared attack surface: the insomnia-plugin-* naming convention that Kong never locked down.
A systematic teardown of the longest-running single-namespace npm attack in the Contagious Interview campaign's history: 70+ chai-as-* packages, runtime-triggered credential theft, a multi-tenant C2, and a naming strategy built to vanish into developer dependency trees.
ts-ankle v1.1.0 is the visible tip of a four-package cluster built around a 17-module cross-platform infostealer. One package impersonates Polymarket. One plants your SSH key.
22 malicious versions across four @immobiliarelabs Backstage plugins carry the Miasma worm's Phantom Gyp payload, targeting Backstage-connected developer environments with credential theft and AI assistant persistence.
A package named express-plugin shipped a remote code execution dropper that fetches and evaluates attacker-controlled JavaScript on every require call, with no install hook needed.
A package posing as the Crossmint Wallets SDK shipped a fully functional credential stealer named after a known worm family. Eight versions, one live C2, and a persistence payload that survives package removal.
A PyPI package named openblox hides a chr-arithmetic obfuscated mshta dropper inside a fake SQLite utility, executing a remote HTA payload on every pip install on Windows.
An attacker published 10 dependency confusion packages targeting Zomato, Hyperpure, and Blinkit in a 199-second scripted burst, exfiltrating full CI environments to an Interactsh collector on every npm install.
The npm package @osmura/treeify appended 93KB of RC4-obfuscated JavaScript to the legitimate treeify library, running an AES-256-GCM dropper with dual IIFE fallback C2 on every require call.
Nine related npm packages across four publisher accounts built a two-stage dropper network active since June 9, 2026, sharing jsonkeeper C2 infrastructure and a common code template across every variant.
What SBOMs contain, what regulators require by country, and why 2026 supply chain incidents still start with the same question: are we affected?
