Two coordinated supply chain attacks – one assessed by [source] to be linked to UNC1069 (North Korea-linked), one to financially motivated group TeamPCP – injected credential-stealing backdoors into the Axios npm package and the Trivy vulnerability scanner, tools used by millions of development and security teams worldwide. Downstream victims include OpenAI, the European Commission, and AI startup Mercor; Google’s Threat Intelligence Group assessed that hundreds of thousands of secrets may have been exfiltrated. Stolen credentials are actively fueling ransomware, SaaS exploitation, and extortion campaigns, and OpenAI has set a hard May 8, 2026 deadline after which older macOS app versions will be blocked due to a compromised signing certificate.