#TeamPCP
All CosmicBytez Labs articles tagged #TeamPCP, across news, security advisories, how-to guides, and projects.
- News
Two Alleged TeamPCP Supply-Chain Hackers Arrested in Australia
AFP charges two Western Australia men with 14 cybercrime offenses tied to TeamPCP's Shai-Hulud worm and LiteLLM, GitHub supply-chain attacks.
- News
Australian Police Charge Two Men Over TeamPCP Supply Chain Attacks
AFP charges two Western Australian men over TeamPCP's March 2026 compromise of Trivy, Checkmarx KICS, and LiteLLM in a global supply chain campaign.
- News
TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign
New analysis traces the cloud threat actor TeamPCP to Redis cryptojacking campaigns active since 2020, revealing a six-year evolution from opportunistic...
- News
How Software Development's Speed Obsession Enabled TeamPCP's Chaos Crusade
TeamPCP's remarkable success attacking open-source software was no accident — it exploited a cultural vulnerability baked into modern development: the...
- News
The Hackers Behind Shai-Hulud: Lucky or Skilled?
TeamPCP's Shai-Hulud worm inflicted serious damage on the open source ecosystem — but a close look at their operations raises the question of whether their.
- News
GitHub Breached — Employee Device Hack Led to Exfiltration
GitHub is investigating unauthorized access to thousands of internal repositories after an employee device was compromised through the TanStack npm supply...
- News
GitHub Confirms Being Hacked by TeamPCP, Says Customer Data
GitHub has officially confirmed it was breached by the TeamPCP threat actor after the group advertised stolen internal source code on a cybercrime forum....
- News
GitHub Confirms Breach, 4K Internal Repos Stolen
GitHub has confirmed a data breach in which the TeamPCP threat actor stole approximately 4,000 internal repositories. The company states no customer data...
- News
GitHub Investigating TeamPCP Claimed Breach of ~4,000
GitHub is investigating unauthorized access to its internal repositories after the TeamPCP threat actor listed approximately 4,000 GitHub internal repos...
- News
Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account
Cybersecurity researchers have discovered a fresh Mini Shai-Hulud supply chain attack compromising the @antv npm ecosystem through a hijacked maintainer...
- News
Four Malicious npm Packages Deliver Infostealers and Phantom Bot DDoS Malware
Researchers have uncovered four malicious npm packages embedding infostealer malware and a Phantom Bot DDoS payload — one of which is a direct clone of...
- News
Shai-Hulud Worm Clones Spread After Code Release
The public release of the Shai-Hulud worm source code by TeamPCP has triggered a wave of copycat variants appearing across the npm ecosystem. Security...
- News
TanStack Supply Chain Attack Hits Two OpenAI Employee
OpenAI has disclosed that two corporate employee devices were compromised via the Mini Shai-Hulud supply chain attack on the TanStack npm ecosystem,...
- News
TeamPCP Hackers Advertise Mistral AI Source Code Repos for Sale
The TeamPCP threat group claims to have stolen source code repositories from Mistral AI and is advertising them for sale on criminal forums, threatening...
- News
TeamPCP Ups the Game, Releases Shai-Hulud Worm's Source Code
The hacking group TeamPCP has publicly released the source code for its Shai-Hulud supply chain worm, actively encouraging other threat actors to...
- News
Mini Shai-Hulud Worm Compromises TanStack, Mistral AI
TeamPCP has expanded its supply chain attack campaign with a fresh Mini Shai-Hulud worm that compromised npm and PyPI packages from TanStack, UiPath,...
- News
Worm Redux: Fresh Mini Shai-Hulud Infections Bite npm
Hundreds of npm packages in the TanStack open source ecosystem have been infected by a fresh wave of Mini Shai-Hulud worm activity from TeamPCP — the same...
- Newsletter
May 12 Digest: AI-Generated Zero-Day, Shai-Hulud Worm
Google confirms the first AI-generated zero-day in the wild; TeamPCP's Mini Shai-Hulud worm hits TanStack, Mistral AI, and Guardrails AI; Instructure pays...
- News
TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks
Supply chain threat actor TeamPCP has struck again, publishing a tampered version of the Checkmarx Jenkins AST plugin to the Jenkins Marketplace — just...
- News
1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, and Intercom
The TeamPCP threat group's Mini Shai-Hulud supply chain campaign compromised SAP-related npm packages along with PyTorch Lightning and Intercom client...
- News
TeamPCP Hits SAP npm Packages With 'Mini Shai-Hulud' Supply
The threat actor TeamPCP has compromised multiple npm packages tied to SAP's cloud application development ecosystem in a new supply chain campaign dubbed...
- News
Vect 2.0 Ransomware Acts as Wiper Thanks to Design Error
The emerging Vect 2.0 ransomware — deployed against TeamPCP supply chain attack victims — permanently destroys files larger than 131KB due to a critical...
- News
How LiteLLM Turned Developer Machines Into Credential
The TeamPCP threat actor's March 2026 supply chain attack against LiteLLM exposed a dangerous blind spot: developer workstations running local AI agents...
- News
EU Cyber Agency Attributes Major Data Breach to TeamPCP
ENISA has officially attributed the massive European Commission data breach — and a wider campaign affecting 30 EU institutions — to the TeamPCP hacking...
- News
European Commission Confirms Data Breach Linked to Trivy
The European Commission has confirmed a major data breach of its AWS environment, with over 300GB of data stolen — including personal information of EU...
- News
Blast Radius of TeamPCP Attacks Expands Amid Hacker
As organizations disclose breaches tied to TeamPCP's supply chain attacks, ShinyHunters and Lapsus$ are taking credit and creating a murky attribution...
- News
CERT-EU: European Commission Hack Exposes Data of 30 EU
CERT-EU has attributed the European Commission cloud account compromise to the TeamPCP threat group, revealing the breach exposed sensitive data from at...
- News
Mercor Confirms Security Incident Tied to LiteLLM Supply
AI hiring platform Mercor has confirmed a security incident linked to the LiteLLM PyPI supply chain attack carried out by TeamPCP. Separately, Lapsus$...
- News
TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides
The TeamPCP threat actor — behind previous supply chain attacks on Trivy, KICS, and litellm — has now compromised the telnyx Python package on PyPI,...
- Newsletter
Mar 26 Digest: LeakBase Admin Arrested, WebRTC Skimmer
This week: Russian authorities detain the alleged LeakBase admin weeks after the FBI-led global crackdown on the 147,000-subscriber stolen-data...
- News
Trivy Hack Spreads Infostealer via Docker, Triggers Worm
The Trivy supply chain attack has expanded dramatically beyond GitHub Actions: malicious Docker Hub images (versions 0.69.4–0.69.6) carry an infostealer,...
- News
Trivy Supply Chain Attack Targets CI/CD Secrets
The open-source Trivy security scanner was weaponized by threat actor TeamPCP in a supply chain attack that hijacked 75 release tags to deploy an...