endorlabs.comarticleSolarWinds took a nation-state. The next attack just needs an LLM and $5. | Blog | Endor Labs
Endor Labs blog tracing an accelerating pattern of software supply-chain compromises from July 2025 through March 2026, culminating in the TeamPCP threat actor's cascading 30-day compromise of Aqua Security, Trivy, GitHub Actions, Docker Hub, npm, OpenVSX, and PyPI (including backdooring the 95M-download LiteLLM package). It argues AI is accelerating both offense (CVE-GENIE reproducing 51% of CVE exploits for $2.77 each) and the attack surface (the Cline prompt-injection-to-npm-token-theft chain, Nx's AI-review-evading payload), and calls for treating AI coding agents as privileged actors, pinning GitHub Actions to SHAs, and platform-level fixes like immutable tags and Sigstore/OIDC.
Organisations named here
- Dan Lorenc
- PostHog
- pull_request_target
- Shai-Hulud
Technologies named here
- CVE-GENIE
- Aqua Security
- Trivy
- Sigstore
- OIDC
- Docker Hub
- npm
- Open VSX
- PyPI
- Checkmarx
- LiteLLM
- eslint-config-prettier
- eslint-plugin-prettier
- synckit
- is
- Nx build platform
- Cline AI coding assistant
- GitHub Actions
- tj-actions/changed-files
- Cline
- CrowdStrike
- Postman
- Zapier
- Chainguard
Techniques named here
- Software supply chain compromise cascade
- Phishing to steal npm maintainer publish tokens
- Self-propagating npm worm
- Prompt injection via GitHub issue title
- Malicious preinstall scripts
- Mutable Git tag poisoning
- pull_request_target exploitation
- LLM-based automated exploit reproduction
- Malicious/poisoned MCP servers and tool configurations
Threat actors named here
- TeamPCP
- Xploiters
- Vect
- Shai-Hulud
- Shai-Hulud 2.0
Related in Supply Chain
