The developer ecosystem is having a very bad week, and it only started on Monday. Three separate — but suspiciously concurrent — software supply chain attacks are now active simultaneously, hitting GitHub repositories, npm, PyPI, Crates.io, and Laravel package repositories within a 72-hour window.

The biggest in raw numbers is Megalodon. Attackers used fake automated commits to inject malicious GitHub Actions workflows into over 5,500 public repositories. The payloads are designed to silently harvest credentials, CI/CD secrets, API keys, and tokens — the kind of artefacts that let you move laterally into an organisation's cloud environment long after the infected repo has been cleaned up. It's a particularly devious vector because the commits look like routine bot activity; the sort of thing that gets lost in the noise of a busy repo's commit history.

Running in parallel is TrapDoor, a cross-ecosystem campaign that seeded 34 malicious packages across more than 384 versions into npm, PyPI, and Crates.io — all three of the major open-source package registries at once. The first packages appeared on 22 May and new waves kept arriving in clusters, suggesting a coordinated, scripted rollout rather than opportunistic one-offs. The payload is credential-stealing malware, consistent with Megalodon's goals.

Then there's the Laravel-Lang poisoning: legitimate-looking tags were published to well-known Laravel internationalisation packages within a 15-minute window — a tight timestamp that points to automation — and the malicious tags introduced backdoors specifically aimed at exfiltrating CI secrets.

These three campaigns may or may not share the same threat actor. What's notable is the timing: they either reflect a coordinated offensive or — more unsettlingly — multiple independent groups who've all decided this week is a good time to go after the software supply chain. Either explanation is bad.

Why this matters beyond the individual incidents: The developer tooling ecosystem has become the preferred attack surface for anyone who wants to reach organisations at scale without having to compromise them directly. A poisoned package or workflow can deliver attacker access to hundreds of downstream environments. The economics are brutal — one successful plant into a popular package is worth more than dozens of phishing campaigns.

For Australian teams, the exposure is direct. Australian software shops pulling from npm, PyPI, or Crates.io — which is basically everyone — should be auditing their dependency trees and CI/CD pipeline configurations now. The ACSC's Secure Software Development guidelines flag third-party dependencies as a primary risk vector, and these campaigns are a live demonstration of exactly why.

What to do right now: Pin your dependencies to specific, verified commit hashes rather than floating version tags. Audit recent GitHub Actions workflow changes, especially automated commits from unfamiliar bot accounts. Rotate any secrets that may have been exposed in CI environments in the last week. And treat any new package published in the last few days with extra suspicion until the registries confirm their sweep is complete.

The registries are aware and removing packages, but with 384+ versions across three ecosystems, the clean-up will take time — and the damage already done to pipelines that pulled early versions won't be undone by a registry takedown.