Protos Labs

Protos Labs is a cybersecurity research firm whose threat intelligence unit tracked and published findings on the UNC6780/TeamPCP supply-chain campaign in mid-2026. The firm documented the Shai-Hulud 3.0 open-source release, the Megalodon copycat wave that poisoned 5,561 GitHub Actions repositories on 18 May, the Miasma variant, and the Phantom Gyp technique that emerged on 3 June 2026 exploiting the npm binding.gyp native-build step. Protos Labs also confirmed that malicious packages in these campaigns carried valid SLSA provenance attestations, a finding with broad implications for software supply-chain security standards.

The firm's public reporting on the Shai-Hulud campaign provided the primary technical analysis used by the wider security community to understand the scope of UNC6780's open-sourcing strategy and the binding.gyp evasion vector. This kind of disclosure work, characterising novel frameworks shortly after their release, is a core function of boutique threat intelligence firms that can move faster on emerging campaigns than larger vendors with broader product commitments.

Protos Labs occupies a niche between enterprise threat-intelligence platforms and academic security research, producing practitioner-facing reports aimed at security operations teams and package-registry administrators. Its focus on software supply-chain security positions it in an increasingly competitive space alongside firms such as Snyk and Socket Security.