Supply‑chain software attacks escalate
Two recent supply‑chain compromises — an alleged Databricks intrusion and a poisoned Axios npm package — show attackers are weaponizing widely used developer and analytics dependencies, threatening data integrity and operational continuity. That single compromised library or platform can stall reporting pipelines and invalidate dashboards unless data lineage and governance controls are enforced. ( )
Databricks has acknowledged an investigation into an alleged link to the TeamPCP campaign but has not published a public incident statement or forensic confirmation as of March 30, 2026. (vpncentral.com)) The TeamPCP campaign began with a Trivy compromise on March 19, 2026 and researchers say the actor force‑pushed malicious commits to 76 of 77 trivy-action tags and published backdoored Trivy binaries, a supply‑chain path tracked as CVE‑2026‑33634 (CVSS 9.4). (sans.org)) Threat actors and multiple analysis teams report the campaign has exfiltrated roughly 300 GB of compressed credentials and claims indicate about 500,000 corporate identities were harvested across infected tools and packages. (thecybersecguru.com)) Researchers say TeamPCP weaponized stolen CI credentials to pivot from Trivy into Checkmarx GitHub Actions, Docker images, PyPI and dozens of npm packages, spawning a self‑propagating worm that abused post‑install scripts and mutable action tags to reach developer build environments. (sysdig.com)) The Axios incident involved poisoned releases—axios@1.14.1 and axios@0.30.4—published from a compromised maintainer account that injected a hidden plain‑crypto‑js dependency which drops a cross‑platform RAT; security teams removed the tainted versions from npm within hours on March 31, 2026. (stepsecurity.io)) Operationally, security advisories advise checking CI/CD workflow runs from the March 19–24 window, rotating any secrets accessible to those runners, pinning GitHub Actions to immutable commit SHAs, and auditing build logs for unexpected post‑install activity to contain credential theft and rebuild trust in analytics pipelines. (tenable.com)
