This week, attackers did not need novel malware or credential stuffing campaigns. They published packages through a trusted pipeline that signed them with valid cryptographic proof. They logged into network control planes as authenticated peers. They extracted 8 terabytes of semiconductor IP while a factory floor kept running. And a Pennsylvania pharmaceutical company learned, via a global manufacturing shutdown, that its incident response plan had a gap between “detected intrusion on May 4” and “filed 8-K on May 7.”
The common thread is not sophistication. It is patience and precision against trust relationships that defenders assume are verified: verified supply chain provenance, authenticated SD-WAN peering, trusted vendor platforms, drug packaging manufacturers that are not hospitals but feed hospitals.
This week: how TeamPCP weaponized GitHub Actions to publish malicious packages that carry cryptographically valid provenances and then worm their way through the npm ecosystem, why a ransomware attack on an injectable drug packaging manufacturer is a healthcare crisis with no hospital named in the headline, what the sixth Cisco SD-WAN zero-day of 2026 tells us about a China-nexus actor that has been sitting inside network control planes since at least 2023, and how a hardware supply chain just handed adversaries 8 terabytes of manufacturing documentation for products built by Apple, Nvidia, Google, and Intel.
Update: Instructure/Canvas
Instructure paid a ransom to ShinyHunters late on May 11, receiving what the company described as “digital confirmation of data destruction” and a commitment that no Instructure customers would face further extortion. The Register obtained reporting that the initial intrusion exploited an XSS vulnerability in Canvas’s Free-for-Teacher environment, and that the May 7 second intrusion, which injected ransom demands directly into hundreds of Canvas school login portals, used the same unpatched vulnerability. The decision to pay did not close the incident.
The House Homeland Security Committee, chaired by Representative Andrew Garbarino, opened a formal investigation the same day the ransom was paid, calling for a briefing with Instructure CEO Steve Daly before May 21 and citing “the demonstrated inability of a major educational technology vendor to contain a threat actor following an initial intrusion” as a systemic vulnerability the committee has a responsibility to examine. The PowerSchool precedent from 2025 is relevant here: paying ransoms to extortion groups that operate a pay-or-leak model does not guarantee that copies of stolen data held by downstream actors are also destroyed. Institutions relying on Instructure’s assurances about data destruction should be prepared for that possibility to be tested.
Mini Shai-Hulud: TeamPCP Poisons TanStack and 160+ Packages, Defeats SLSA Provenance at Scale
What happened:
On May 11, 2026, between 19:20 and 19:26 UTC, an attacker published 84 malicious versions across 42 @tanstack/* npm packages by chaining three GitHub Actions vulnerabilities: the pull_request_target “Pwn Request” pattern, GitHub Actions cache poisoning across the fork and base trust boundary, and runtime memory extraction of an OIDC token from the GitHub Actions runner process. The attack, attributed to threat group TeamPCP and dubbed Mini Shai-Hulud, spread to Mistral AI, UiPath, and over 160 additional npm and PyPI packages within hours, totaling 404 malicious package versions. OpenAI confirmed on May 14 that two corporate employee devices were compromised, with “credential-focused exfiltration activity” observed in a limited subset of internal source code repositories. No customer data or production systems were affected, but compromised macOS code-signing certificates forced the company to require all macOS users to update their applications before June 12 or lose app functionality. This is the first documented supply chain attack to publish malicious npm packages carrying valid SLSA provenance attestations, the cryptographic supply chain security guarantee designed to verify a package was built from a trusted source.
Technical details that matter:
- Initial Access: The attacker forked TanStack/router under the account zblgg, renaming the fork “zblgg/configuration” to avoid appearing in fork-list searches. A pull request was opened that triggered the pull_request_target workflow. A malicious commit was authored under the fabricated identity “[email protected],” impersonating the Anthropic Claude GitHub App, and prefixed with [skip ci] to suppress automated CI analysis on push.
- Cache Poisoning: The triggered workflow checked out and executed the attacker’s fork code, which poisoned the GitHub Actions cache with a malicious pnpm store. When legitimate maintainer PRs were later merged to main, the release workflow restored the poisoned cache, and attacker-controlled binaries extracted OIDC tokens directly from the GitHub Actions runner’s process memory via /proc/pid/mem.
- SLSA Bypass: Because the malicious packages were published by TanStack’s legitimate release workflow using its trusted OIDC identity, they carried valid Sigstore SLSA provenance. Every static provenance check passed. The attacker never stole npm credentials.
- Self-Propagation: The payload enumerates other packages the victim npm account maintains and republishes them with the same injected malware, enabling exponential spread through the registry from a single compromised maintainer machine.
- C2 Architecture: Triple-channel exfiltration using the typosquat domain git-tanstack[.]com, the decentralized Session messenger network via getsession.org seed nodes (end-to-end encrypted with no attacker-controlled C2, making IP and domain blocking the only network mitigation), and GitHub API dead drops where stolen tokens create Dune-themed repositories.
- Persistence and Destruction: Drops a daemon at ~/Library/LaunchAgents/com.user.gh-token-monitor.plist (macOS) or ~/.config/systemd/user/gh-token-monitor.service (Linux). Payload files router_init.js and setup.mjs survive npm uninstall. An updated payload observed on May 13 includes a rm -rf wiper activated if token revocation is detected before daemon removal.
- Attribution: TeamPCP previously compromised Aqua Security’s Trivy scanner (March 2026) and the Bitwarden CLI npm package (April 2026). Each wave of Shai-Hulud attacks builds on the previous wave’s technical sophistication.
Why critical institutions should care:
@tanstack/react-router alone receives over 12.7 million weekly downloads. UiPath’s packages are embedded in enterprise automation pipelines across financial services, healthcare, and government. The Mistral AI SDK is in use in many organizations’ internal AI tooling. But the significance of this incident is not the scale of the blast radius. It is what TeamPCP did to provenance attestation.
SLSA provenance is the current answer in the industry to the question “how do we know this package was built from a trusted source?” Requiring SLSA attestation has been standard supply chain hardening advice for two years. TeamPCP demonstrated that malicious packages can carry valid attestation by compromising the pipeline rather than the credentials, because the attestation certifies the identity of the pipeline, not the integrity of the code the pipeline executed. Any security program that has checked “require provenance attestation” off its supply chain hardening list and stopped there now has an open question about whether that control is sufficient. For organizations running affected packages, the immediate task is to check developer and CI machines for the persistence daemon before rotating credentials; the wiper activates on revocation if the daemon is still running.
Key sources:
- https://tanstack.com/blog/npm-supply-chain-compromise-postmortem
- https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised
- https://snyk.io/blog/tanstack-npm-packages-compromised/
- https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/
- https://therecord.media/openai-asks-macos-users-to-update-tanstack-npm
West Pharmaceutical Services: Ransomware Shuts Down Global Drug Delivery Manufacturing
What happened:
West Pharmaceutical Services, a Pennsylvania-based manufacturer of injectable pharmaceutical packaging and delivery systems, detected unusual activity on May 4, 2026, and took systems offline globally as a precaution. On May 7, the company filed an 8-K with the SEC confirming a “material cybersecurity attack” in which data was exfiltrated and certain systems were encrypted. The containment measure disrupted business operations globally. As of May 14, the company has contained the attack and restarted critical processes including manufacturing, receiving, and shipping at some sites, with restoration of remaining sites still in progress. Palo Alto Networks’ Unit 42 handled incident response. No ransomware group has publicly claimed responsibility, which SecurityWeek notes may indicate a ransom was paid. The company has not disclosed the type of data stolen, whether personal information was involved, or how many individuals may be affected.
Technical details that matter:
- Attack Vector: Not publicly disclosed. Initial detection on May 4 with a May 7 SEC filing suggests the company required three days to determine the event constituted a material cybersecurity incident, consistent with an attacker who completed exfiltration before deploying encryption.
- Execution: Data exfiltration preceded ransomware deployment, the standard double-extortion sequence that maximizes negotiation leverage. The company told the SEC it “has taken steps intended to mitigate the risk of dissemination of the exfiltrated data,” language that in the current ransomware ecosystem consistently implies payment or active negotiation with the attacker.
- Containment: Following detection, West Pharmaceutical proactively shut down and isolated affected on-premise infrastructure, restricted access to enterprise systems, activated crisis management protocols, and notified law enforcement.
- No Claim: The absence of a public claim from a ransomware operator is the most operationally significant detail in the public record. Groups that do not receive payment typically publish within their stated deadline windows. West Pharmaceutical’s silence on attribution, combined with the SEC’s “steps to mitigate dissemination” language, is consistent with a payment.
- Unit 42’s assurance letter confirming unauthorized activity was contained was published by West on May 13, indicating IR concluded that active threat actor access had been severed.
Why critical institutions should care:
West Pharmaceutical Services supplies injectable packaging and drug delivery systems used widely across the healthcare sector, raising concerns about potential downstream impacts on critical medical production environments. The pharmaceutical manufacturers that rely on West’s packaging and delivery systems as a critical supply chain input face potential downstream impact if production delays affect their own manufacturing schedules.
The ransomware operators who targeted West Pharmaceutical did not need to breach a hospital to threaten healthcare continuity. West sits three supply chain tiers upstream from a patient receiving medication: West makes the packaging components, pharmaceutical manufacturers use those components to package drugs, and hospital pharmacies distribute those drugs. A global manufacturing shutdown at West is a drug supply event, not just a security event. The healthcare industry, per Errol Weiss of Health ISAC, is seeing “a sustained, high level of malicious activity targeting the healthcare sector” in 2026, with the same access and techniques usable “interchangeably for espionage, financial gain, or destructive impact.” For hospital systems and healthcare networks, this incident is a reminder that supply chain risk mapping that stops at direct technology vendors and does not extend to critical manufacturing suppliers is incomplete.
Key sources:
- https://www.securityweek.com/west-pharmaceutical-services-hit-by-disruptive-ransomware-attack/
- https://www.bleepingcomputer.com/news/security/west-pharmaceutical-says-hackers-stole-data-encrypted-systems/
- https://therecord.media/west-pharmaceutical-warns-of-ransomware-attack-impacting-operations
- https://industrialcyber.co/manufacturing/ransomware-attacks-on-west-pharmaceutical-and-foxconn-highlight-growing-cyber-risks-to-manufacturing-sector/
CVE-2026-20182 / UAT-8616: Sixth Cisco SD-WAN Zero-Day of 2026, China-Nexus Actor Has Owned Your Network Control Plane Since 2023
What happened:
On May 14, 2026, Cisco disclosed CVE-2026-20182, a critical authentication bypass vulnerability (CVSS 10.0) in Cisco Catalyst SD-WAN Controller and Manager, and confirmed it was being exploited in the wild. It is the sixth SD-WAN vulnerability with confirmed exploitation to come to light in 2026. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on May 14, mandating remediation for federal agencies by May 17 under Emergency Directive 26-03. CVE-2026-20182 was discovered by Rapid7 researchers Jonah Burgess and Stephen Fewer while researching CVE-2026-20127, the earlier SD-WAN auth bypass exploited in February. The vulnerabilities affect the same component but represent different flaws. Cisco Talos attributed active exploitation of CVE-2026-20182 with high confidence to UAT-8616, characterizing the group as “a highly sophisticated cyber threat actor” that has been exploiting Cisco SD-WAN infrastructure since at least 2023. The infrastructure used by UAT-8616 overlaps with Operational Relay Box (ORB) networks that Talos monitors, and Google Mandiant has previously documented that China-nexus threat actors use ORB networks when conducting espionage operations.
Technical details that matter:
- Vulnerability: CVE-2026-20182 exploits a failure in the peering authentication mechanism of the vdaemon service over DTLS (UDP port 12346). An attacker sends crafted requests to become an authenticated peer of the target SD-WAN Controller, logging in as an internal, high-privileged, non-root user account, and then accessing NETCONF (SSH over TCP port 830) to issue arbitrary network configuration commands across the entire SD-WAN fabric.
- Privilege Escalation: After initial access, UAT-8616’s documented pattern is to downgrade the SD-WAN software to a version that exposes CVE-2022-20775, a local privilege escalation, to achieve root access. After reaching root, the actor restores the original software version to conceal the exploitation path from any detection logic that checks installed software versions.
- Persistence and Evasion: SSH key injection into /home/vmanage-admin/.ssh/authorized_keys and /home/root/.ssh/authorized_keys, with PermitRootLogin set to “yes” in sshd_config. Extensive forensic artifact clearance targeting syslog, wtmp, lastlog, bash_history, and cli-history files. Cisco Talos flags absent or near-zero-byte log files as a high-fidelity IOC.
- Additional Threat Clusters: Cisco Talos identified 10 distinct threat clusters separate from UAT-8616 that have been exploiting the CVE-2026-20133/20128/20122 chain since March 2026, following publication of proof-of-concept code by ZeroZenX Labs. Those clusters deployed webshells to compromised SD-WAN infrastructure.
- No Workarounds: Cisco’s advisory states there are no workarounds for CVE-2026-20182. Affected organizations must upgrade to a fixed software release or remove internet exposure of SD-WAN controller peering services.
- The most reliable high-fidelity IOC per Talos is unauthorized entries in /var/log/auth.log of the format “Accepted publickey for vmanage-admin” from unknown or unauthorized IP addresses.
Why critical institutions should care:
SD-WAN controllers are the management plane for an organization’s entire wide-area network fabric. Root access to the SD-WAN Controller means the ability to alter routing policies, inspect traffic, insert malicious network configurations, create unauthorized control plane peers, and use the device as a pivot into any network segment routable from the WAN fabric, including OT-adjacent and segmented environments. This is the system that distributes network policy, not just a system that forwards packets. A compromise at this layer is more consequential than a compromised appliance because the attacker is inside the system that defines what networks exist and how traffic moves between them.
Talos has found evidence that UAT-8616’s malicious activity went back at least three years to 2023. Any organization that operated an internet-accessible Cisco Catalyst SD-WAN Controller at any point in the last three years, regardless of current patch status, should treat this as a potential persistent access event and review Talos’s published IOCs, including SSH authorized_keys files, sshd_config modifications, and log file sizes, before concluding their environment was not involved.
Key sources:
- https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/
- https://www.tenable.com/blog/faq-about-the-continued-exploitation-of-cisco-catalyst-sd-wan-vulnerabilities-uat-8616
- https://www.helpnetsecurity.com/2026/05/15/cisco-sd-wan-zero-day-cve-2026-20182/
- https://www.securityweek.com/cisco-patches-another-sd-wan-zero-day-the-sixth-exploited-in-2026/
- https://thehackernews.com/2026/05/cisco-catalyst-sd-wan-controller-auth.html
Foxconn / Nitrogen Ransomware: 8TB of AI and Semiconductor Manufacturing IP Stolen from North American Plants
What happened:
On May 11, 2026, the Nitrogen ransomware group posted Foxconn on its extortion portal, claiming to have stolen 11 million files from the company’s North American manufacturing operations. Nitrogen claimed the extracted files included confidential instructions, internal project documentation, and technical drawings related to projects involving Intel, Apple, Google, Dell, Nvidia, and other companies. Foxconn, a critical supplier for major hardware companies, confirmed the attack on May 12, stating its cybersecurity team “immediately activated the response mechanism and implemented multiple operational measures to ensure the continuity of production and delivery.” Foxconn had initially described the incident as a “technical issue” before confirming the cyberattack. The company’s Mount Pleasant, Wisconsin facility, which produces high-end servers and AI infrastructure rather than Apple devices, and its Houston, Texas facility appear to be the affected sites. Workers at some sites were temporarily forced to use pen and paper or stay home while IT systems were offline.
Technical details that matter:
- Attack Vector: Not publicly disclosed. Foxconn has not shared details on initial access methodology.
- Nitrogen’s lineage: Built on leaked Conti 2 ransomware source code, with organizational and technical links to the ALPHV/BlackCat ecosystem. Barracuda Networks characterizes the group as “sophisticated and financially motivated,” first observed as a malware developer and operator in 2023.
- The 8TB claim with sample files posted publicly on the dark web as proof of breach is consistent with Nitrogen’s double-extortion playbook: establish credibility with samples, then apply pressure via a payment deadline before full public release.
- Despite Nitrogen’s claims that Apple project files were among the stolen data, available sample files do not appear to contain Apple circuit diagrams or product development documents. The Wisconsin facility primarily manufactures servers and AI infrastructure, not Apple devices.
- Foxconn has now been targeted by DoppelPaymer (2020), LockBit (2022, 2024), and Nitrogen (2026), with each incident involving a different facility and a different ransomware operator, suggesting Foxconn is a persistent high-value target across the ransomware ecosystem rather than a victim of opportunistic scanning.
Why critical institutions should care:
The Foxconn breach is a hardware supply chain intelligence event as much as it is a ransomware incident. Foxconn is not a vendor to most organizations; it is the manufacturer that makes the hardware other vendors deliver to those organizations. Foxconn reported revenues of over $260 billion in 2025 and manufactures products for Apple, Nvidia, Intel, Google, and others. Stolen technical documentation for server hardware and AI infrastructure from the world’s largest contract manufacturer can provide adversaries with detailed manufacturing specifications, production tolerances, potential design weaknesses, and sufficient technical documentation to support counterfeit component operations affecting the entire downstream customer base.
For defense contractors and federal agencies that procure server or AI infrastructure hardware manufactured by or for Foxconn’s OEM clients, the exposure of internal project documentation and technical drawings represents a supply chain integrity risk that extends well beyond Foxconn’s facilities. The incident underscores growing ransomware threats facing the manufacturing sector, where cyberattacks can disrupt manufacturing operations and product distribution while simultaneously exfiltrating IP of significant value to state-sponsored actors with an interest in hardware design details. The Wisconsin facility’s specific focus on AI infrastructure and server production for the companies named in Nitrogen’s claims makes the stolen documentation particularly sensitive given current geopolitical competition in advanced semiconductor and AI hardware development.
Key sources:
- https://www.bleepingcomputer.com/news/security/electronics-giant-foxconn-confirms-cyberattack-on-north-american-factories/
- https://www.theregister.com/cyber-crime/2026/05/12/foxconn-confirms-cyberattack-after-nitrogen-claims-apple-nvidia-data-theft/5239144
- https://therecord.media/foxconn-confirms-cyberattack-north-american-factories
- https://industrialcyber.co/manufacturing/ransomware-attacks-on-west-pharmaceutical-and-foxconn-highlight-growing-cyber-risks-to-manufacturing-sector/
The Pattern This Week
Last week’s incidents shared a theme of adversaries reducing the expertise barrier: using trusted platforms, legitimate remote management tools, and commercial AI to reach objectives that would have required specialized skills a few years ago. This week’s incidents show the next step: adversaries are not just lowering the barrier to attack. They are systematically removing the evidence trail that defenders rely on to know the attack occurred.
TeamPCP published malicious packages that cleared every automated provenance check because the pipeline that generated the attestation was the compromised element. UAT-8616 achieved root access on Cisco SD-WAN Controllers, completed post-compromise objectives, restored the original software version, and wiped the log files. West Pharmaceutical’s ransomware operators completed exfiltration before encryption, ensuring the company had no leverage left to refuse payment and no forensic trail of what was taken. Nitrogen extracted 8 terabytes from Foxconn’s North American operations while the company described the incident as a “technical issue.”
In each case, the security controls that generate alerts and feed detection pipelines were bypassed, neutralized, or outpaced before the alert fired. Provenance attestation passed. Logs were cleared. Encryption came after exfiltration, not with it. Manufacturing systems stayed online long enough that an initial “technical issue” characterization was plausible.
The defender’s problem this week is not that the tools failed. It is that the adversaries in all four cases understood which specific controls generate evidence and built their operations around completing objectives before those controls could fire. SLSA provenance without pipeline integrity monitoring is a credential check without runtime verification. SD-WAN hardening without anomaly detection on peering connections is configuration without behavioral baselining. The answer in every case is not a new tool. It is treating absence of evidence as evidence, because the adversaries doing the most damage this week are the ones who make sure the logs look clean.
See you next week
For the Business Side: Three Reviews Worth an Hour of Your Week
1. Map your software supply chain two levels deeper than you currently track. The TanStack/Mini Shai-Hulud attack compromised packages with over 12 million weekly downloads, and it reached OpenAI, Mistral AI, and UiPath not because those organizations had poor security practices, but because they used a library that used a CI/CD pipeline that had a trust boundary vulnerability. Most organizations have a software bill of materials that tracks direct dependencies. Almost none track the CI/CD pipeline configurations of those dependencies, or whether the packages they consume are enrolled in provenance attestation programs that have themselves been tested against pipeline-level compromise. The question to bring to your engineering and security leads is not “do we use TanStack?” It is “if one of our top twenty open-source dependencies was compromised at the pipeline level rather than the credential level, would our controls catch it before the malicious version reached our developers?” If the honest answer is “we would rely on an external researcher filing a public issue,” that is the gap to close. Start with your highest-download dependencies in active CI/CD pipelines and confirm whether behavioral install-time scanning is in place, not just provenance checks.
2. Pull your Cisco SD-WAN peering logs now, before you patch. Patching CVE-2026-20182 is the right action and the deadline is May 17 for federal agencies. But patching removes the vulnerability, not the attacker. Cisco Talos has documented that UAT-8616 has been exploiting SD-WAN infrastructure since at least 2023, restoring software versions after privilege escalation and wiping log files to cover its tracks. Any organization that has operated Cisco Catalyst SD-WAN Controller or Manager with internet-accessible peering services in the last three years should treat this as a potential historic compromise, not just a current patch priority. Before your team patches and considers the matter closed, pull /var/log/auth.log and search for “Accepted publickey for vmanage-admin” entries from IP addresses you do not recognize. Check authorized_keys files for the vmanage-admin and root accounts for SSH keys that are not in your inventory. Review sshd_config for PermitRootLogin set to “yes.” If any of those checks surface anomalies, the incident started years ago and patching is step two, not step one.
3. Run your pharmaceutical and medical supply chain vendors through your critical third-party risk framework. West Pharmaceutical Services manufactures injectable drug packaging and delivery components used across the healthcare sector. Its ransomware attack caused a global manufacturing shutdown that disrupted shipping, receiving, and production at facilities worldwide. If you are a hospital system, a healthcare network, or a pharmaceutical manufacturer, your direct technology vendors are almost certainly inside your third-party risk program. West Pharmaceutical probably is not, because it is a manufacturing supplier rather than a software or IT services vendor. That is the gap this incident exposes. Ask your supply chain and procurement teams to identify the five manufacturers or logistics providers whose operational disruption would affect your ability to deliver patient care or fulfill drug manufacturing commitments, regardless of whether they handle your data or run software connected to your network. If those organizations are not inside your third-party risk monitoring program, the West Pharmaceutical incident is the argument for why they should be. Ransomware operators have understood for years that manufacturing suppliers upstream of hospitals are high-leverage targets. Your risk framework needs to catch up.