Google Warns Open-Source Software Attacks Are Scaling Faster Than Defenses Can Match

Three hours is the window Google's threat team had to contain the March 2026 hijack of the axios code library, a single dependency pulled into roughly 100 million web projects every week. Three hours was enough to pull the malicious versions. It was not enough to keep them out of installs already running, and it was not enough to stop a months-long parallel campaign that, by Google's count, poisoned packages accounting for another 100 million weekly downloads.

Google's Threat Intelligence Group now assesses, with high confidence, that very large-scale open-source supply-chain compromise has significantly expanded in 2025 and early 2026, and projects the campaigns will keep growing through the rest of 2026 and beyond (GovInfoSecurity, August 3, 2026, summarizing Google Threat Intelligence Group, May 2026). The "open-source supply chain" here is the web of public code packages, dependencies, and maintainer accounts that nearly every modern application is built on; the npm registry is the world's largest pool of JavaScript packages and the one most of these cases touched.

The March 2026 axios compromise was a maintainer-account takeover. The North Korea-linked threat actor Midnight Neptune phished the credentials of the legitimate axios package maintainer (axios is the npm HTTP-client library used by tens of thousands of other packages, not the news outlet) and pushed malicious versions that the registry removed in roughly three hours. Socket's analysis puts axios at more than 100 million weekly downloads; Google says the impact rippled across at least 15 industries and 13 countries (Socket, March 2026).

While the npm maintainers were cleaning axios, a months-long campaign called Shai-Hulud was doing something nastier. Shai-Hulud, named for the sandworms in the Dune novels, is a self-replicating worm that infects npm packages and harvests developer credentials. The cluster behind it, tracked by Google as both TeamPCP and UNC6780, ran two late-2025 waves that touched packages accounting for about 20 million weekly downloads. Its 2026 campaign, by Google's count, hit packages adding up to roughly 100 million weekly downloads, and used a poisoned VS Code extension to siphon 3,800 internal GitHub repositories. The same wave hit the Trivy vulnerability scanner and the LiteLLM AI integration tool, and dropped a credential stealer called Sandclock that targeted AWS keys and GitHub tokens on developer machines.

The 2026 campaign also opened a new attack surface: AI. Google flags AI integration into open-source development, including "vibe coding" with AI coding assistants, as both a target and a force multiplier. The HiddenLayer research team reported in May that attackers injected malicious code into a Hugging Face Open-OSS privacy-filter repository, where it accumulated 200,000 downloads before being caught. The security firm Koi documented a malicious npm package impersonating the Postmark MCP server that silently BCC'd an attacker on every outgoing email, exposing password resets, invoices, and confidential messages. And ReversingLabs showed that the North Korea-linked group Famous Chollima tricked Anthropic's Claude Opus coding agent into adding a malicious dependency to a cryptocurrency project.

The thread is that the public code ecosystem is being treated as infrastructure, and the attackers are scaling with the dependency graph. The 20-million-to-100-million trajectory across Shai-Hulud's waves, the roughly three-hour window between a poisoned axios release and its removal, and the steady expansion from maintainer phishing to AI-assisted package generation are not four separate stories. They are the same category of operation, repeated.

Google's forward-looking call is the news. The company expects very large-scale, worm-style open-source compromise to keep growing through 2026 and into the years after, because the economics now favor attackers: one maintainer account, or one AI-assisted package, can reach a hundred million weekly installs in a single push. The watch items are public package registries, maintainer-account hygiene, and the provenance of any code generated by an AI coding agent. Three hours was the defense this time. It is the clock the next wave is being measured against.