The numbers
5
COORDINATED ATTACK WAVES — MAR–MAY 2026
170+
MALICIOUS PACKAGES WITH VALID SLSA L3 PROVENANCE
3,800
PRIVATE GITHUB REPOS EXFILTRATED AND LISTED FOR SALE
Wave by wave
WAVE 01MAR 19–24INITIAL ACCESS
The security tool attack
Compromised release credentials used to publish malicious Aqua Trivy v0.69.4, backdoor Checkmarx KICS GitHub Actions, and insert a credential-harvesting .pth payload into LiteLLM PyPI 1.82.7–1.82.8 — triggered globally at Python startup.
Trivy scannerKICS actionsLiteLLM PyPI
WAVE 02MAR 27FOOTPRINT GROWS
Infrastructure expansion
Telnyx Python SDK poisoned on PyPI to extract developer and infrastructure secrets from cloud communications environments — a deliberate expansion beyond security tooling to the entire developer infrastructure layer.
Telnyx PyPI SDKCredential extraction
WAVE 03APR 22–24ESCALATION
Multichannel exploitation
Checkmarx KICS hit again with stolen tokens. @bitwarden/cli hijacked on npm. Xinference PyPI deployed to target enterprise AI inference environments directly.
Bitwarden CLI npmXinference PyPIDocker Hub
WAVE 04MAY 11–15SELF-PROPAGATING
Mini Shai-Hulud worm
GitHub Actions cache poisoning combined with OIDC token extraction from runner process memory produced 170+ malicious packages with valid SLSA Level 3 provenance — bypassing standard provenance checks entirely. Affected Mistral AI, Guardrails AI, UiPath, OpenSearch, and SAP CAP.
GitHub Actions cacheOIDC tokensValid SLSA L3
WAVE 05MAY 20MOST SEVERE
GitHub internal breach
Poisoned VS Code extension compromised an employee workstation. 3,800 private internal GitHub repositories exfiltrated and listed for sale at $50,000 on underground forums — with stated intent to leak publicly if no buyer.
VS Code extension3,800 private repos$50,000 listing
The pattern
Every wave used an official channel — PyPI, npm, Docker Hub, VS Code marketplace, GitHub Actions. The AI stack was targeted deliberately across every wave: LiteLLM, Xinference, Mistral AI, Guardrails AI. And 170+ packages carried valid SLSA Level 3 provenance, meaning standard supply chain checks passed them without issue.
THE LESSON
Provenance checks confirm where a package came from. They don't confirm what it does at runtime. The attack didn't forge credentials — it stole legitimate ones. The packages were genuinely signed. Runtime enforcement at the execution layer is the only control that operates after a dependency has already passed every pre-deployment check.