GoKawiilAustralia charges two men over TeamPCP open-source supply-chain hacking spree
The Australian Federal Police, working with the FBI and Western Australia Police, arrested and charged a 21-year-old and a 23-year-old accused of belonging to TeamPCP, a hacking collective blamed for injecting malicious code into widely used open-source packages. The group's tampered code allegedly reached over a thousand organizations, including GitHub, OpenAI, Mistral AI, SAP and the European Commission, leading to theft of roughly half a million credentials and exfiltration of at least 300GB of data.
GoKawiil's interpretation of the reporting above, not reported fact.
The case underscores how a handful of compromised open-source components can cascade into global damage, with remediation costs estimated in the hundreds of millions of dollars. It also shows that such large-scale supply-chain attacks can stem not from sophisticated state actors but from loosely affiliated individuals coordinating over Discord and Telegram, raising fresh questions about how open-source ecosystems vet contributions.
- Two Australian men, 21 and 23, were arrested and charged over TeamPCP-linked hacking.
- Malicious code hit popular packages like Trivy, LiteLLM, TanStack, SAP and Telnyx, plus GitHub, OpenAI and Mistral AI.
- Attacks reportedly compromised 1,000+ organizations, stole 500,000 credentials, and exfiltrated 300GB of data.
Yubico YubiKey 5C NFC Security Key — Supply-chain attacks like TeamPCP's thrive on stolen credentials and authentication tokens, and a hardware security key is one of the strongest defenses against account takeover. The YubiKey 5C NFC plugs into USB-C or taps via NFC to add phishing-resistant two-factor authentication to GitHub, npm, cloud consoles, and password managers. It's a pocket-sized upgrade for any developer who publishes packages other people depend on.
See Yubico YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-08-27
Published there as: “Australia arrests alleged TeamPCP hackers behind supply-chain attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.