A backdoor was inserted into upstream XZ Utils release tarballs, affecting some downstream Linux distribution packaging before broad removal.
WebGL graph loadingActor to Incident
Supply Chain GraphPan, zoom, and select actor, campaign, and incident tiers.
Supply Chain graph is loading. Keyboard controls become available after graph initialization.
Corpus Graph
Supply Chain
A graph-first view of curated supply chain incidents and the packages, repositories, organizations, maintainers, actors, campaigns, releases, and accounts connected by evidence.
35
Incidents
31
Packages
12
Releases
17
Repositories
27
Organizations
6
Maintainers
7
Build Systems
19
Distribution Channels
18
Compromised Accounts
227
Relationships
How They Got In
Attack Vectors
Who Is Connected
Attribution
Observed To Disclosure
Dwell Timeline
Go BoltDB typosquat module proxy backdoor1191dSolarWinds Orion software build compromise287dASUS Live Update Operation ShadowHammer83devent-stream malicious dependency insertion78dCodecov Bash Uploader credential exfiltration74dXZ Utils backdoor attempt34dCCleaner signed installer compromise34dShai-Hulud 2.0 npm supply-chain worm wave15dMegalodon GitHub Actions repository workflow poisoning campaign10dNx Console VS Code extension compromise10dnode-ipc peacenotwar protestware release8dOctopus Scanner malicious NetBeans project campaign8d
Featured Cases
Incident Cards
Attackers compromised 3CX desktop application builds, causing trojanized installers and updates to reach downstream customers.
Attackers compromised the SolarWinds Orion build process and inserted the SUNBURST backdoor into signed software updates delivered to customers.
A maintainer transfer enabled a malicious dependency to be added to the event-stream npm package dependency tree, targeting downstream cryptocurrency wallet software.
Malicious versions of ua-parser-js were published to npm after maintainer account compromise, delivering credential-stealing and cryptomining payloads.
What Threatpedia Tracks
This section models confirmed supply chain incidents and the entities named by the corpus. The goal is structured recall: which packages, repositories, maintainers, and organizations appear together in public evidence.
Why Supply Chain Incidents Matter
A supply chain compromise can turn trusted update channels, build systems, or package registries into distribution paths. Tracking those links helps defenders compare incidents without inventing risk scores.
How Entities Connect
Entities are connected through explicit relationship records derived from the curated incident corpus. A package, repository, organization, or maintainer page shows the incidents that support that connection.
Evidence and Confidence Model
Each incident carries confidence and evidence-level fields from the corpus. Pages show those fields directly and avoid conclusions beyond the recorded evidence.
Lineage Views
Malware Families
Corpus Shape
Entity Summary
Packages
Named software packages affected by or involved in supply chain incidents.
Repositories
Source repositories, release repositories, and project repositories cited by incident evidence.
Organizations
Vendors, projects, companies, registries, and public organizations connected to incidents.
Maintainers
Individual maintainers or maintainer identities named by the structured corpus.
Build Systems
Build, CI, release, or signing systems recorded as part of the incident chain.
Distribution Channels
Registries, update systems, downloads, and other channels used to distribute affected artifacts.
Compromised Accounts
Accounts or identities recorded as compromised in the incident corpus.
Corpus Index
All Incidents
3CX desktop application software supply-chain compromiseAttackers compromised 3CX desktop application builds, causing trojanized installers and updates to reach downstream customers.Build CompromiseAqua Trivy CI/CD supply-chain compromiseAttackers compromised Trivy release and GitHub Action distribution paths, causing affected CI/CD environments to run credential-stealing code through trusted scanner workflows.Ci Cd CompromiseASUS Live Update Operation ShadowHammerAttackers compromised the ASUS Live Update utility and distributed signed malicious updates to selected downstream systems.Distribution CompromiseAxios npm maintainer account compromiseA compromised Axios maintainer account published malicious npm releases that added plain-crypto-js as an install-time dependency delivering a cross-platform remote access trojan.Account CompromiseCCleaner signed installer compromiseA legitimate CCleaner release was modified and signed, distributing malware to downstream users through the normal software update and download path.Distribution CompromiseCheckmarx Jenkins AST plugin supply-chain compromiseCheckmarx reported that attackers used access traced to the Trivy supply-chain attack to publish malicious developer-tooling artifacts, including a modified Jenkins AST plugin.Ci Cd CompromiseCodecov Bash Uploader credential exfiltrationThe Codecov Bash Uploader was modified by an attacker, enabling environment variable and credential exfiltration from affected CI environments.Ci Cd Compromisecolors and faker npm protestware releasesThe maintainer of colors and faker published intentionally disruptive releases that broke downstream consumers and demonstrated maintainer-driven supply-chain risk.Package Publishctx PyPI project account takeoverThe ctx project on PyPI was taken over and replaced with malicious code that collected environment variables from affected users.Account CompromiseDependency confusion proof-of-concept campaignResearchers demonstrated that public package registries could be abused to satisfy internal dependency names and execute code in downstream build environments.Dependency Resolutioneslint-scope npm package credential-stealing releaseAn attacker used compromised npm maintainer credentials to publish malicious eslint-scope and eslint-config-eslint releases that attempted to steal npm tokens.Account Compromiseevent-stream malicious dependency insertionA maintainer transfer enabled a malicious dependency to be added to the event-stream npm package dependency tree, targeting downstream cryptocurrency wallet software.Package PublishGo BoltDB typosquat module proxy backdoorSocket researchers disclosed a backdoored Go module typosquatting BoltDB that persisted through Go Module Proxy caching even after the source repository tag was changed.Dependency ResolutionKaseya VSA ransomware supply-chain attackAttackers abused Kaseya VSA management software to distribute ransomware through managed service provider environments to downstream customers.Distribution CompromiseLedger Connect Kit npm package compromiseA compromised Ledger Connect Kit npm release injected malicious code into downstream web applications and targeted cryptocurrency wallet transactions.Account CompromiseLinux Mint ISO distribution site compromiseAttackers modified Linux Mint download infrastructure so some users received a backdoored ISO image instead of the legitimate distribution image.Distribution CompromiseLiteLLM PyPI package compromise through stolen CI/CD credentialsMalicious LiteLLM versions 1.82.7 and 1.82.8 were published to PyPI with code not present in the upstream repository, exposing Python users and AI pipelines to credential theft.Package PublishLottieFiles lottie-player npm package compromiseCompromised releases of the @lottiefiles/lottie-player npm package injected malicious wallet-draining code into downstream web applications.Account CompromiseMegalodon GitHub Actions repository workflow poisoning campaignThe Megalodon campaign inserted malicious GitHub Actions workflows into thousands of public repositories to harvest CI/CD secrets and cloud credentials through automated commit activity.Source CompromiseMini Shai-Hulud TanStack npm and PyPI supply-chain waveMini Shai-Hulud compromised TanStack release automation and spread across npm and PyPI packages through trusted publishing, cache poisoning, and credential theft from CI/CD environments.Package Publishnode-ipc peacenotwar protestware releaseThe node-ipc npm package included protestware behavior that modified files for users in certain geographies, creating downstream integrity and availability risk.Package PublishNotPetya distributed through M.E.Doc update channelThe NotPetya destructive malware outbreak was seeded through a compromised Ukrainian accounting software update mechanism used by M.E.Doc customers.Distribution CompromiseNx Console VS Code extension compromiseA malicious Nx Console 18.95.0 extension release was briefly distributed through VS Code and OpenVSX marketplaces, compromising developer systems and exposing credentials.Distribution CompromiseOctopus Scanner malicious NetBeans project campaignMalicious code planted in open source NetBeans projects propagated through developer builds and attempted to infect additional projects.Source CompromisePHP source repository backdoor attemptAttackers pushed malicious commits to the PHP source repository that would have introduced a backdoor if accepted into releases.Source CompromisePolyfill.io CDN script supply-chain compromiseThe Polyfill.io service began serving malicious JavaScript to downstream websites that embedded the third-party CDN script.Distribution CompromisePyTorch nightly dependency confusion compromiseA malicious torchtriton package on PyPI was installed by some PyTorch nightly users because it shadowed an expected dependency name.Dependency Resolutionrc npm package malicious releaseThe rc npm package had malicious versions published that required users to downgrade and inspect systems for suspicious activity.Package PublishShai-Hulud 2.0 npm supply-chain worm waveA second Shai-Hulud wave compromised hundreds of npm packages through install-time malware, GitHub token theft, and public repositories containing exfiltrated secrets.Package PublishShai-Hulud npm self-propagating package compromiseThe Shai-Hulud campaign compromised npm packages with credential-harvesting malware that used stolen npm tokens to publish malicious versions of additional packages.Package PublishSolarWinds Orion software build compromiseAttackers compromised the SolarWinds Orion build process and inserted the SUNBURST backdoor into signed software updates delivered to customers.Build Compromisetj-actions changed-files GitHub Action compromiseThe tj-actions/changed-files GitHub Action was compromised, exposing secrets from affected workflow runs through malicious action behavior.Ci Cd Compromiseua-parser-js npm package account compromiseMalicious versions of ua-parser-js were published to npm after maintainer account compromise, delivering credential-stealing and cryptomining payloads.Account CompromiseUltralytics PyPI package compromiseThe ultralytics Python project suffered a supply-chain attack through compromised GitHub Actions workflows and PyPI publishing, resulting in malicious package releases.Ci Cd CompromiseXZ Utils backdoor attemptA backdoor was inserted into upstream XZ Utils release tarballs, affecting some downstream Linux distribution packaging before broad removal.Source Compromise