Key judgments

JudgmentBasisConfidence
Credential theft is the common objective across recent software-ecosystem and SaaS-integration compromises.Package worms that harvested developer and cloud tokens; an OAuth token theft campaign that searched stolen data for cloud keys; a stealer used in package compromises.High
Developer environments and build pipelines are the most exposed part of the software supply chain.CISA and the UK NCSC both describe attacks that spread through maintainer accounts, install-time scripts and automated pipelines.High
Connected SaaS applications are a distinct exposure from vendor networks. A single stolen integration token can reach many customers.Google Threat Intelligence Group (GTIG) analysis of the Salesloft Drift campaign, where the platform vendor was not the weak point.High
Third-party involvement in breaches is rising, and vendors are slow to fix basic identity weaknesses.Verizon reports third-party involvement in 48 percent of breaches, up 60 percent year over year.Medium to high
Stolen supply-chain credentials feed later ransomware and extortion.GTIG reports credentials from one package-compromise group were reportedly sold on. M-Trends finds prior compromise is the top confirmed initial vector in ransomware cases.Medium

Three channels, one pattern

“Supply chain” covers three different routes. They fail differently and need different controls, which is why a single vendor questionnaire cannot cover them.

ChannelDocumented exampleHow it spreadWhat the attacker took
Software dependenciesShai-Hulud, a self-replicating worm that infected more than 500 npm packages (CISA alert as reported). A later NCSC-described variant followed the same logic.Compromised maintainer account. Malware checked the infected machine for other packages the maintainer controlled and injected itself into them.GitHub tokens, cloud API keys, passwords and configuration files, uploaded to a public repository
Connected applicationsUNC6395 and Salesloft Drift. GTIG states the issue did not stem from a vulnerability in the core Salesforce platform.Stolen OAuth tokens tied to a third-party application. Scope later widened beyond the Salesforce integration.Customer records, then a search of that data for AWS keys, passwords and Snowflake tokens
AI and developer toolingTeamPCP claimed compromises of Trivy, Checkmarx, LiteLLM and BerriAI (GTIG). Claimed by the actor; reported by GTIG.Compromised PyPI packages and malicious pull requests.Credentials, via the SANDCLOCK stealer; reportedly sold to ransomware and extortion groups

How the pattern works

  • Trust is borrowed. The malicious code or token arrives through a channel the victim has already approved: a package manager, an integration, a signed update path.

  • Secrets are harvested first. The Drift actor ran count queries to size the data, exported it, then searched for credentials. GTIG assessed the primary intent was to harvest credentials.

  • Stolen secrets open the next door. Cloud keys and repository tokens give access to more systems and more packages. In the npm worm, the same stolen access was used to publish further infected packages.

  • Detection arrives late. The NCSC notes a malicious package can spread across many organizations before it is spotted, and that later attacks of this type went undetected for longer than the first.

Where the exposure appears

Developer workstations and pipelines

The NCSC points out that developer devices are usually less tightly controlled than managed corporate devices, and that node and Python ecosystems run install-time scripts, so code can execute the moment a package is installed. A build server that holds deployment keys and pulls unreviewed updates turns one poisoned dependency into production access.

The integration inventory nobody owns

Few organizations can list every application holding an OAuth grant into their CRM, email or data platform, or say what scope each grant carries. In the Drift case, the first advice to customers was to treat every token connected to the platform as compromised and to review all third-party integrations. That advice is only actionable if the inventory exists.

Vendor identity hygiene

Verizon reports that only 23 percent of third-party organizations had fully remediated missing or improperly secured MFA on cloud accounts. Findings for weak passwords and permission misconfigurations took almost eight months to resolve for half of the cases. A vendor with write access to your environment inherits those timelines.

What should change

ChangeWhySignal to watch
Stop adopting new dependency versions automatically. Review updates, pin versions and route releases through controlled pipelines.The NCSC recommends avoiding automatic adoption, pausing updates when compromise is possible, and deploying through controlled CI/CD rather than developer devices.New or unexpected dependencies; install-time scripts in updates
Hold secrets outside developer workstations and give pipeline credentials short lives.Worms and stealers collect tokens from developer machines first. Short-lived credentials limit what theft gains.Token use from new hosts; secrets published to public repositories
Inventory every connected application and its OAuth scopes. Remove “API enabled” style permissions where they are not needed.The Drift guidance centred on revoking tokens, restricting connected-app scope and reviewing integrations.New grants; bulk data queries from integration identities
Require MFA on registry, source-control and vendor accounts. Make it a contract term where vendors hold access.Maintainer account compromise started the npm worm. Vendor MFA gaps were slow to close.Vendor accounts without MFA; dormant vendor access
Rehearse the cut. Decide in advance who can revoke a vendor’s access and rotate shared secrets, and test it.In both the npm and Drift cases, rotation of credentials was the core remediation step.Time to revoke and rotate in an exercise

Hunting hypotheses

  • Search for repositories or build logs containing cloud key patterns, and for tokens used outside normal working locations.

  • Review integration identities for large record exports, especially queries that count records first.

  • Look for package installs that spawn network connections or read credential files.

  • Check for vendor accounts that authenticate without MFA or from new locations.

Intelligence gaps

  • Scale of downstream harm is unclear. Package and token counts describe what was infected or exposed, not how many organizations suffered loss.

  • Actor claims are not verified. The TeamPCP compromises are reported by GTIG as claimed by the group.

  • Third-party statistics depend on definitions. Verizon’s 48 percent counts breaches with third-party involvement. It does not mean vendors caused 48 percent of breaches.

  • Vendor reporting reflects vendor visibility. Several sources are security vendors describing events seen on their own platforms.

Claim discipline: incident details are as published by the named sources. Interpretation and recommendations are the author’s analysis.

**

Sources

  1. Google Threat Intelligence Group, “Widespread Data Theft Targets Salesforce Instances via Salesloft Drift”, Google Cloud Blog. cloud.google.com

  2. Google Threat Intelligence Group, “Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access” (TeamPCP and SANDCLOCK), Google Cloud Blog. cloud.google.com

  3. Google Threat Intelligence Group, “GTIG AI Threat Tracker” (QUIETVAULT credential stealer), Google Cloud Blog. cloud.google.com

  4. The Record, “CISA urges orgs to review software after Shai-Hulud supply chain compromise” (report of the CISA alert). therecord.media

  5. UK National Cyber Security Centre, “Software supply chain attacks: check your dependencies”. ncsc.gov.uk

  6. Verizon, Data Breach Investigations Report, latest edition, executive summary: third-party involvement and remediation findings. verizon.com

  7. Google Cloud / Mandiant, M-Trends, latest edition: ransomware initial vectors. cloud.google.com

How we label evidence

Facts carry a source. Analysis and recommendations are marked as ours. Examples that are hypothetical are labeled as hypothetical.

Part of the solutionDetect, Respond & RecoverSpot attacks early and get back to business fast.See how we work →

Related service

Threat Intelligence

Use this to improve threat-informed security decisions.

Talk to an ExpertSee this service →Related articles →
Also relevant:Threat & Attack Path AnalysisThreat HuntingThird-Party & Supply-Chain Risk