TeamPCP Supply Chain Operations — Operators Charged and Large-Scale Open-Source Ecosystem Poisoning (Estimated CWE-506 / Supply Chain Attack)

Publication date: August 27, 2026
Category: Cybercrime / Supply Chain Attacks

Introduction

The Australian Federal Police (AFP), in a joint operation with the Western Australia Police Force (WAPF) and the Federal Bureau of Investigation (FBI), has charged two Western Australian men with a combined total of 14 offenses over their alleged role in the TeamPCP cybercrime syndicate. The group is accused of orchestrating the compromise of open-source security scanners and AI gateways —including Trivy, Checkmarx KICS, and LiteLLM— by stealing and weaponizing publishing credentials across continuous integration and continuous delivery (CI/CD) pipelines. This case underscores the systemic vulnerability of automated dependencies and the enduring risks of token exposure in modern development workflows.

What is TeamPCP and the Supply Chain Risk? (General Analysis)

TeamPCP operates as a cybercrime syndicate specializing in the automated compromise of open-source code repositories and the injection of malicious packages into official distribution channels. The group exploits weaknesses in CI/CD secret management, where third-party service authentication tokens are exposed through previously compromised builds.

Because this does not map to a traditional software vulnerability residing in a specific single CVE, this class of incident is analytically classified under CWE-506: Embedded Malicious Code (Trojan Horse) alongside token exposure flaws (CWE-798: Use of Hard-coded Credentials), carrying an estimated severe impact (CVSS v3.1: 9.8 Critical due to remote code execution and widespread infrastructure compromise).

How Does It Work? (Technical Analysis)

The operational mechanics of TeamPCP rely on a lateral movement infection chain spanning multiple package ecosystems:

  • Initial Infection and Chained Compromise: The actors gain unauthorized access to trusted project distribution channels using stolen credentials. The compromise of one project yields tokens leveraged against the next target (e.g., credentials harvested during the Trivy scanner compromise were turned against Checkmarx KICS actions days later).
  • CI/CD Pipeline Injection: Tools like LiteLLM installed dependencies (such as Trivy) without pinning them to verified cryptographic commit hashes. The poisoned scanner intercepted and extracted the project’s publishing token, allowing the attackers to push backdoored releases in late March.
  • Exfiltration and Persistence: The use of automated worm frameworks and dynamic repositories (such as those identified in FBI advisories under the names tpcp-docs and docs-tpcp) facilitated the harvesting of over 500,000 credentials and mass data exfiltration into compressed archives exceeding 300 GB.

Affected Systems / Environments

The campaign impacted five primary distribution ecosystems and multiple integration platforms:

  • Package Ecosystems: GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX.
  • CI/CD Platforms and Repositories (per StepSecurity and CloudSEK datasets):
    • GitLab (leading with over 1,064 affected organizations)
    • GitHub Actions (618 organizations)
    • Azure DevOps (233 organizations)
    • Jenkins (105 organizations)
    • Bitbucket Pipelines (94 organizations)
    • CircleCI (15 organizations)
  • Specific Components Targeted: Trivy security scanners, Checkmarx KICS, LiteLLM gateway, and npm packages including keyv and cacheable.

Mitigation and Detection

Remediation

  • Immediate Secret Rotation: Rotate all CI/CD secrets, npm/PyPI publishing tokens, and cloud credentials that were accessible during the documented exposure windows.
  • Version Pinning: Ensure that all GitHub Actions workflows and build dependencies are strictly pinned to full SHA commit hashes (e.g., @hash) rather than floating version tags.
  • Dependency Auditing: Review official registry publication histories to detect orphaned or unauthorized package builds.

Detection

  • Monitor execution logs within CI/CD pipelines for anomalous outbound requests targeting unknown domains or infrastructure historically linked to TA-NATALSTATUS / IronErn.
  • Hunt for repository artifacts matching tpcp-docs or docs-tpcp created by malicious automation scripts.

Threat Intelligence Warning: Impacted organizations must assume that all data and credentials exfiltrated during the initial exposure windows represent a persistent, long-term risk, as threat actors frequently weaponize and monetize such access months after the initial compromise.

Wrapping Up

The arrest of alleged TeamPCP operators in Australia marks a significant milestone in the international crackdown against open-source supply chain poisoning syndicates. Nevertheless, the incident demonstrates that blind trust in automated dependencies and poor token management in CI/CD pipelines remain critical attack vectors. The strict adoption of hash-based version pinning and aggressive credential rotation are indispensable defenses against this class of persistent threats.

References