NEW YORK — What happened: On September 22, 2026, security researchers identified a software supply chain campaign affecting open-source package repositories including PyPI and npm. Over 120 compromised packages were uploaded containing build-time scripts designed to exfiltrate temporary continuous integration and continuous deployment (CI/CD) access tokens to remote command servers.
Why it matters: Modern software engineering relies heavily on automated pipelines that automatically build, test, and deploy applications. If malicious code infects a developer library used during the build phase, it can capture build secrets and grant attackers direct access to cloud production environments.
Deep dive: The attackers compromised developer accounts using session-hijacking techniques targeting web browser cookies rather than cracking credentials. Once inside the maintainers' accounts, they published modified patch updates for popular utility libraries. The malicious payload executed silently during dependency installation inside automated GitHub Actions and GitLab CI runners.
Report check: Registry maintainers verified that all identified malicious package versions were removed within six hours of detection. Rumors that major cloud provider root keys were stolen during the breach have been investigated and debunked by third-party incident response teams.
Open questions: Will package registries move to enforce hardware security key authentication for all package publication commands to eliminate cookie-hijacking vector risks?