Supply Chain Apocalypse Now: npm, PyPI, and Docker Hub Under Siege — What Every Australian SMB Must Do Today

---

April 2026: The Week Supply Chain Security Broke

For three days in late April, the software supply chain became a shooting gallery. Three distinct threat actors — or one highly coordinated group — launched simultaneous attacks across the ecosystems that Australian developers trust every time they type npm install or docker pull.

None of these attacks aimed to break your app. They aimed to steal the keys to your kingdom: GitHub tokens, AWS credentials, npm publish rights, SSH keys, and environment variables. And in several cases, the malware was designed to spread itself automatically.​‌‌‌​​‌‌‍​‌‌‌​‌​‌‍​‌‌‌​​​​‍​‌‌‌​​​​‍​‌‌​‌‌​​‍​‌‌‌‌​​‌‍​​‌​‌‌​‌‍​‌‌​​​‌‌‍​‌‌​‌​​​‍​‌‌​​​​‌‍​‌‌​‌​​‌‍​‌‌​‌‌‌​‍​​‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌‌​‌​​‍​‌‌‌​‌​​‍​‌‌​​

​​‌‍​‌‌​​​‌‌‍​‌‌​‌​‌‌‍​‌‌‌​​‌‌‍​​‌​‌‌​‌‍​​‌‌​​‌​‍​​‌‌​​​​‍​​‌‌​​‌​‍​​‌‌​‌‌​‍​​‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌‌​‌​‌‍​‌‌‌​​‌‌‍​‌‌‌​‌​​‍​‌‌‌​​‌​‍​‌‌​​​​‌‍​‌‌​‌‌​​‍​‌‌​‌​​‌‍​‌‌​​​​‌‍​‌‌​‌‌‌​‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌‌​‌‍​‌‌​​​‌​‍​​‌​‌‌​‌‍​‌‌‌​‌​‌‍​‌‌‌​​‌​‍​‌‌​​‌‌‌‍​‌‌​​‌​‌‍​‌‌​‌‌‌​‍​‌‌‌​‌​​

Incident 1: Checkmarx KICS — The Security Scanner That Turned on Its Users

On 22 April, Docker flagged suspicious activity on the official checkmarx/kics repository. KICS (Keeping Infrastructure as Code Secure) is a security scanner used by thousands of engineering teams — including many Australian consultancies and MSPs — to scan Terraform and Kubernetes manifests inside CI/CD pipelines.

The compromised Docker images contained an obfuscated payload that harvested GitHub authentication tokens, AWS, Azure, and Google Cloud credentials, npm configuration files, SSH keys, and every environment variable it could reach. Everything was compressed, encrypted, and exfiltrated.

The blast radius was massive: any pipeline that pulled checkmarx/kics:latest during the compromise window handed its secrets to the attacker. The threat actor group TeamPCP claimed responsibility on X immediately after disclosure. This was their second Checkmarx attack in two months.

The lesson: tools you run inside CI/CD have access to everything your pipeline touches. A compromised scanner is a skeleton key.

Incident 2: CanisterSprawl — The Worm That Jumps Ecosystems

On 21 April, malicious versions of pgserve, a PostgreSQL server for Node.js, appeared on npm. The payload was a credential-harvesting script that executed via a postinstall hook — meaning it ran automatically on every npm install, no user action required.

CanisterSprawl, as tracked by Socket and StepSecurity, searches infected machines for npm publish tokens. For every package the victim can publish, it bumps the patch version, injects itself, and publishes the infected package back to npm. If it finds a PyPI token on the same machine, the worm jumps ecosystems entirely — from npm to Python.

Its command-and-control infrastructure uses an Internet Computer Protocol (ICP) canister, a decentralised channel that is extremely difficult to takedown. Follow-up investigation linked compromised Namastex.ai npm packages to the same methods.

The lesson: a single compromised developer laptop can poison dozens of packages across multiple registries.

Incident 3: xinference — TeamPCP Returns to PyPI

On 22 April, three consecutive releases of xinference on PyPI carried a credential-stealing payload. The malware decoded a second-stage collector that harvested SSH keys, cloud credentials, environment variables, and cryptocurrency wallets.

StepSecurity attributed this to TeamPCP, the same group behind the litellm and telnyx PyPI compromises in March 2026. The xinference payload sent a plain tar.gz directly to the attacker's C2 server — no encryption, no subtlety, just raw exfiltration.

The lesson: threat actors are iterating faster than defenders. TeamPCP moved from npm to PyPI to Docker Hub within weeks, refining their tradecraft each time.

---

How These Attacks Actually Work

The common thread across all three campaigns: none needed a zero-day vulnerability. Every attack exploited trust.

• Compromised maintainer credentials: phishing, credential stuffing, or token theft gave attackers publish rights to legitimate packages.
• Postinstall hooks: malicious code that executes automatically when a package is installed — no user interaction needed.
• CI/CD pipeline access: once inside a build environment, the malware reads every environment variable, config file, and mounted secret.
• Self-propagation: harvested npm/PyPI tokens are used to publish infected versions of other packages, creating a chain reaction.

The attackers weren't interested in your source code or your database. They wanted the credentials that let them come back later — or sell access to ransomware operators.

---

What Australian SMBs Must Do Right Now

You do not need a security operations centre to defend against these attacks. You need discipline.

1. Lock Your Dependencies — Actually Lock Them

• Use package-lock.json (npm) or yarn.lock and commit it. Never use --no-lockfile.
• For Python, use pip freeze > requirements.txt with exact versions, or adopt pipenv/poetry lock files.
• Verify lockfiles haven't been tampered with: npm ci instead of npm install in CI/CD. npm ci respects the lockfile exactly and fails if it doesn't match package.json.

2. Pin to Commit SHAs in GitHub Actions

Never reference a GitHub Action by tag (e.g., actions/checkout@v4). Tags can be moved. Always pin to the full commit SHA:

- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2

Tools like StepSecurity's restrict-github-actions can enforce this automatically.

3. Enable Dependabot or Renovate — But Configure Them Safely

• Dependabot: enabled natively in GitHub under Settings > Code security > Dependabot alerts. It flags known-vulnerable dependencies and can auto-open PRs.
• Renovate: more configurable than Dependabot. Pin its version to a commit SHA in your config and set automerge: false for all non-dev dependencies.
• Critical guardrail: never auto-merge dependency PRs. The GitGuardian analysis of the Checkmarx KICS attack found that automation tools silently merged malware in minutes. Every update PR gets a human review.

4. Audit Your Installed Packages — Today

Run these commands right now:

# npm: check for known compromised versions
npm audit
npm ls axios pgserve chalk debug

# Python: check installed packages
pip list | grep -iE "xinference|litellm|telnyx"

# Docker: check pulled images
docker images | grep -iE "checkmarx|trivy"

If you find compromised versions, update immediately and rotate every secret those CI/CD pipelines had access to.

5. Rotate Secrets Proactively

Assume any secret that touched a CI/CD pipeline in April 2026 is compromised. Rotate:

• npm and PyPI publish tokens
• GitHub personal access tokens
• AWS IAM access keys
• Docker Hub credentials
• SSH keys on developer machines and build servers

Use a secrets manager (AWS Secrets Manager, HashiCorp Vault, or even .env files excluded from git) rather than hardcoding credentials in workflow YAML.

---

FAQ

Conclusion

The April 2026 supply chain blitz wasn't a sophisticated APT operation exploiting zero-days. It was credential theft at industrial scale, enabled by automation that trusted too much and verified too little.

Australian SMBs running Node.js, Python, or containerised workloads should treat this as a fire drill that already happened. Lock your files. Pin your hashes. Review your merges. Rotate your secrets. The attackers are already iterating on their next campaign.

If you're unsure where to start, visit consult.lil.business for a free, no-obligation cybersecurity assessment tailored to Australian small and medium businesses. We'll review your CI/CD posture, dependency hygiene, and secrets management in one session.

---

References

1. No Off Season: Three Supply Chain Campaigns Hit npm, PyPI, and Docker Hub in 48 Hours — GitGuardian
2. Software Supply Chain Attacks 2025–2026: Axios, Shai-Hulud, Chalk — Cyber Army
3. Renovate & Dependabot: The New Malware Delivery System — GitGuardian
4. GitHub Actions Security Hardening — StepSecurity
5. Essential Eight Maturity Model — Australian Cyber Security Centre