Software Supply Chain Security: Inside 2026's npm and PyPI Attack Wave

Two poisoned axios releases sat on npm for roughly three hours before anyone pulled them. A separate campaign republished more than 140 compromised packages in about 88 minutes. These aren't hypothetical scenarios from a security vendor's marketing deck — they're documented incidents from 2026, and they illustrate the actual constraint in software supply chain security: detection and response now have to happen in minutes, not days, because that's the window attackers are operating in (TuxCare).

The scale, by the numbers

Sonatype's 2026 State of the Software Supply Chain Report counted more than 1,233,000 malicious open-source packages cumulatively across npm, PyPI, Maven Central, NuGet, and Hugging Face — with 454,600+ newly identified in calendar 2025 alone, a 75% jump year over year (TuxCare).

Source: TuxCare

Anatomy of a 2026 campaign

Four incidents from 2026 illustrate the range of attack patterns and, critically, the speed:

• axios (March 31) — two poisoned releases published to npm, live for approximately three hours before removal (TuxCare).
• TanStack/Mistral AI (May 11) — a coordinated attack compromised over 170 npm packages and 2 PyPI packages, totaling 404 malicious versions across the campaign (TuxCare).
• Mastra (June 17) — an account/package takeover republished more than 140 packages in roughly 88 minutes (TuxCare).
• TrapDoor — planted 34 malicious packages spread across npm, PyPI, and Crates.io simultaneously, targeting multiple ecosystems in one campaign (TuxCare).
• Shai-Hulud — a separate wave that hit over 100 npm and PyPI packages (SecurityWeek).

npm dominates as a target — present in 63% of all 2026 campaigns and accounting for roughly 4 in 5 indexed malicious packages — largely a function of its scale as the largest package ecosystem. PyPI attacks, while less voluminous, trend toward lower-volume, higher-precision payloads, suggesting more targeted rather than opportunistic campaigns on that ecosystem (TuxCare).

The regulatory picture just shifted

Executive Order 14028 ("Improving the Nation's Cybersecurity," 2021) established SBOM (Software Bill of Materials) requirements for software sold to the US federal government and has shaped procurement expectations broadly since (NIST). But 2026 brought a significant reversal: the Office of Management and Budget (OMB) rescinded several Biden-era mandates. Federal agencies are no longer required to obtain software security attestations from vendors — they may still choose to, based on a "comprehensive risk assessment" — and agencies now have more discretion over whether to require SBOMs at all (Davis Wright Tremaine).

This doesn't mean SBOM requirements disappeared — it means they became risk-based and agency-discretionary rather than blanket-mandatory, which in practice creates inconsistent enforcement across different federal buyers.

Separately, CISA released updated 2026 Minimum Elements for a Software Bill of Materials, replacing the 2021 NTIA baseline, defining 23 elements across three groups: nine SBOM metadata fields, eight component data fields, and six practices/processes fields. These apply broadly — to all software, including open-source, AI software, and SaaS (CISA).

And a separate, more consequential mandate arrived in defense specifically: on July 20, 2026, an Executive Order on "Securing America's Defense Supply Chains" required defense contractors to submit a complete indentured Bill of Materials tracing all components, parts, equipment, software, and materials back to the origin of raw materials, in a standardized format — described as the most consequential BOM mandate since EO 14028 (ReArm HQ).

Regulatory landscape, mid-2026:
  Federal software procurement (general): SBOM now agency-discretionary
                                            (was mandatory under prior EO 14028 guidance)
  CISA SBOM minimum elements:              updated, 23 elements, applies broadly
                                            (open source, AI, SaaS included)
  Defense supply chain (new, July 2026):   MANDATORY, full indentured BOM
                                            tracing to raw material origin

What actually mitigates this at the engineering level

Given attack windows measured in minutes to hours, the practical mitigations are the ones that don't depend on a human reacting in time:

1. Pin exact dependency versions (lockfiles committed and enforced in CI), not version ranges — a ^1.2.0 range can silently pull a compromised 1.2.1 published an hour ago.
2. Delay-gate automatic updates. A short mandatory delay (even 24-72 hours) between a new package version publishing and your CI/CD pulling it gives the ecosystem's own detection tooling time to flag and pull malicious releases before they reach your build — most of the incidents above were caught and removed within hours.
3. Verify package provenance where the ecosystem supports it (npm provenance attestations, Sigstore-signed packages) rather than trusting registry presence alone.
4. Maintain an SBOM regardless of current federal mandate status — given the CISA 2026 minimum elements now explicitly cover SaaS and AI software, and given that "required" status is shifting jurisdiction by jurisdiction, having accurate SBOMs already in place avoids a scramble when a customer or regulator asks.
5. Monitor for known-compromised packages actively, not just at install time — a dependency compromised after you've already pulled it requires ongoing scanning, not a one-time audit.

Actionable takeaway

Audit your CI/CD pipeline specifically for how fast a newly published dependency version can reach production: if the answer is "immediately, on next build," you're exposed to exactly the attack pattern that compromised axios, TanStack, and Mastra in 2026 — all of which were caught and pulled within hours, meaning a same-day auto-update policy would have pulled the malicious version before removal. Add a short update delay, pin lockfiles, and maintain an SBOM now rather than waiting for a specific mandate to apply to you — the CISA 2026 minimum elements already cover SaaS and AI software regardless of what federal procurement currently requires.

Sources: TuxCare, SecurityWeek, NIST, Davis Wright Tremaine, CISA, ReArm HQ