Software supply chain attacks between 2018 and 2026 moved from one hijacked package to self-spreading worms, but the pattern held: attackers took over something trusted (a maintainer, a build step, an update channel) and used it to reach many victims. This page lists ten incidents, each tied to a primary or reputable source.
This is a reference list, not a ranking, and it is not complete. Dates are as stated by the cited source. Link to it freely, and tell us what we should add.
Timeline
- Sep to Nov 2018, event-stream (npm). A new maintainer added a malicious dependency, flatmap-stream, targeting one wallet app's build. npm blog
- Mar to Dec 2020, SolarWinds Orion. A malicious DLL was inserted into the vendor's software lifecycle and signed with its certificate. CISA AA20-352A
- Jan to Apr 2021, Codecov Bash Uploader. The script was altered to send environment data from CI to an external server. Codecov
- Oct 2021, ua-parser-js (npm). Three versions were published with malicious code. GitHub advisory
- Dec 2021, Log4Shell. A critical flaw in a ubiquitous logging library, a vulnerability rather than a tampering. CISA
- May 2022, ctx (PyPI). An expired maintainer email domain was re-registered and the account taken over. The Register
- Mar 2024, XZ Utils. A backdoor in the release tarballs of 5.6.0 and 5.6.1. oss-security, CISA
- Mar 2025, tj-actions/changed-files. A popular GitHub Action was compromised and could disclose CI secrets. CISA
- Sep 2025, Shai-Hulud (npm). A self-replicating worm compromised over 500 packages. CISA
- Aug 2026, Shai-Hulud variant "ChainDrop" (npm). Over 1,300 package versions were compromised, per Singapore's CSA. CSA Singapore AD-2026-009
What happened in each?
event-stream, 2018. According to npm, a new maintainer added flatmap-stream as a dependency in event-stream 3.3.6 on 9 September 2018. The injected code decrypted a hidden payload that only acted in a specific build environment: the Copay wallet. npm was notified on 26 November and removed the package. Most developers who installed it were unaffected, because the payload was targeted.
SolarWinds, 2020. CISA says activity began in at least March 2020 and the advisory was first issued on 17 December 2020, after Emergency Directive 21-01 on 13 December. The entry point was a malicious DLL inserted into the Orion software lifecycle and signed with the vendor's legitimate certificate. In April 2021 the US government attributed the activity to Russia's SVR.
Codecov, 2021. Codecov says unauthorized alterations to its Bash Uploader began on 31 January 2021. A customer reported a checksum mismatch on 1 April, and the script was fixed that day. The altered script sent the output of git remote and the environment to an outside server, so anything in a CI environment could be exposed.
ua-parser-js, 2021. Three versions (0.7.29, 0.8.0, 1.0.0) carried malicious code. The advisory was published on 22 October 2021 with patched versions 0.7.30, 0.8.1 and 1.0.1.
Log4Shell, 2021. CVE-2021-44228 is a critical remote code execution flaw in Log4j 2.0-beta9 through 2.14.1. We include it because it taught the industry the cost of not knowing which products contain a library. CISA's guidance stresses finding every instance, including in vendor software.
ctx, 2022. The package had been unchanged for about eight years. Per The Register, an expired email domain was re-registered and used to take over the PyPI account, and malicious versions appeared around 14 May 2022. PyPI estimated about 27,000 downloads of malicious copies.
XZ Utils, 2024. Andres Freund noticed unusual SSH login CPU use and reported on 29 March 2024 that upstream xz tarballs were backdoored. Affected versions were 5.6.0 and 5.6.1, and the CVE is 2024-3094. The malicious build script sat in release tarballs, which differ from the source repository.
tj-actions, 2025. CISA reports the compromise window for tj-actions/changed-files ran from 12 March 2025 00:00 UTC to 15 March 2025 12:00 UTC, with possible exposure of secrets including access keys and tokens. It recommended treating exposed secrets as compromised and rotating them.
Shai-Hulud, 2025. CISA's alert of 23 September 2025 describes a self-replicating worm that compromised over 500 npm packages by harvesting tokens and cloud keys, then publishing infected versions as the compromised developer.
ChainDrop, 2026. Singapore's CSA advisory of 6 August 2026 reports over 1,300 compromised npm package versions, including keyv and related packages, spreading through stolen developer credentials.
What patterns repeat?
- Trusted channel abuse. Maintainer accounts, signed builds, CI actions and release tarballs.
- Credentials as the prize. From Codecov to the npm worms, stolen tokens fund the next hop.
- Detection by chance or by a customer. A checksum mismatch in 2021, an SSH slowdown in 2024.
- Cleanup is an inventory problem. Everyone had to answer "where do we use this?"
What to do
- Keep an inventory of dependencies and build tools per release.
- Pin versions and actions to immutable references, and verify checksums.
- Use short-lived credentials in CI and rotate after any suspected exposure.
- Require phishing-resistant MFA on registry and source accounts.
- Compare release artifacts with source where you can.
- Delay adoption of brand new releases briefly.
- Rehearse the response runbook once a year.
Quick check
Which incident was a vulnerability rather than a tampering?
Log4Shell. It was a critical flaw in a widely used library, not a malicious change to a package, but it shaped how teams think about knowing what they ship.
Why are credentials central to so many of these?
Stolen tokens and keys let attackers publish as a trusted identity or reach cloud accounts, so each compromise funds the next.
Sources
All linked in the table above, plus:
Last reviewed: 18 October 2026.
