senn-techSupply Chain Attacks: npm and Rust in August 2026
Within a few days in August 2026, targeted supply chain attacks hit three core ecosystems: npm, Rust, and GitLab. JavaScript developers downloaded trojanized packages, Rust builds pulled in compromised crates, and a severe GitLab flaw allowed unauthenticated project modification. At the same time, researchers found thousands of leaked AWS keys were still valid.
npm: RedC2 4.0 on the import path
14 npm packages — identifiable by streak-* names — install the RedC2 4.0 Linux backdoor on import. The payload sits in the installation or module initialization path, so it runs as soon as an application loads the package. No active call to a malicious function is required; mere presence in the dependency tree is enough.
| Vector | Details |
|---|---|
| Package names | streak-* (14 packages) |
| Payload | RedC2 4.0 Linux backdoor |
| Trigger | Import / installation |
| Goal | Reverse shell, persistent access |
The pattern is classic: attackers publish helper packages that look harmless and rely on developers not manually reviewing code before build tools and containers absorb it.
Rust: typosquatting in the build script
Three widely used Rust crates were compromised:
- arrayref@0.3.10
- internment@0.8.7
- append-only-vec@0.1.9
The compromise happened through typosquatting on proc-macro1 by the group Sapphire Sleet. A modified build script downloads extra code during cargo build and steals credentials and crypto wallets from the development environment.
The real danger is reach: arrayref is present in about 75% of Rust cloud environments. One compromised crate with that kind of distribution hits more projects than many targeted individual attacks.
GitLab: CVE-2026-19478
GitLab was assigned CVE-2026-19478, a CVSS 9.4 vulnerability. Through GraphQL code injection, unauthenticated attackers can modify or delete projects. This matters because GitLab is not just the source repository but also the CI/CD pipeline in many organizations. Write access here lets an attacker change build configurations, secrets, and deployments.
AWS keys: leaked and still valid
In parallel, Truffle Security found nearly 9,300 AWS keys that were still valid despite being publicly leaked. The finding underscores that rotating compromised credentials remains the weakest link in many incident-response processes.
What helps now
- Pinning and hashes: Lock dependencies to exact versions plus integrity hashes.
- Private registries with scanning: Scan npm and Cargo packages before internal use.
- Build sandboxing: Run
cargo buildandnpm installin isolated, ephemeral environments with no access to production credentials. - Credential rotation: Replace any exposed AWS keys immediately and add leak scanners to CI.
- GitLab patches: Apply the CVE-2026-19478 patch promptly and audit GraphQL access.
Further reading
How does the npm streak-* package attack work?+
14 packages with streak-* names drop the RedC2 4.0 Linux backdoor as soon as they are imported. The payload sits in the installation or module initialization path and opens a reverse shell without the application actively calling a malicious function. Developers are infected simply by requiring or importing the package.
Why are the compromised Rust crates especially dangerous?+
arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9 were compromised by Sapphire Sleet through a proc-macro1 typosquatting attack. A modified build script downloads extra code during cargo build and steals credentials and crypto wallets from the development environment. arrayref is present in roughly 75% of Rust cloud environments, so one compromised crate reaches enormous scale.
What is the GitLab vulnerability CVE-2026-19478?+
CVE-2026-19478 scores CVSS 9.4. Through a GraphQL code injection flaw, unauthenticated attackers can modify or delete projects. Because GitLab is often the central CI/CD repository, write access here is enough to contaminate the entire software supply chain.