Skip to content

Back to the catalog

Socket: TeamPCP + BreachForums Launch $1,000 Contest for Supply Chain Attacks
socket.devarticle

Socket: TeamPCP + BreachForums Launch $1,000 Contest for Supply Chain Attacks

Socket reports that TeamPCP and the owner of BreachForums are running a $1,000-Monero contest rewarding whoever compromises the highest-download open-source package using the Shai-Hulud worm, with smaller compromises also counting toward the score. TeamPCP has also released Shai-Hulud as open-source attack tooling on the Breached CDN (briefly mirrored on GitHub) and has been systematically targeting security tools, CI/CD workflows, GitHub Actions, Docker images, OpenVSX extensions, npm, PyPI, and Packagist to harvest CI/CD secrets, cloud credentials, and maintainer tokens. The piece ties the contest to TeamPCP's broader access-broker role, noting overlapping downstream extortion claims involving Vect, ShinyHunters, and Lapsus$.

TL;DR TeamPCP and BreachForums are crowdsourcing npm/PyPI/Packagist package compromises with a $1,000 Shai-Hulud worm contest, per Socket's tracking of the group's ongoing supply-chain and CI/CD credential-harvesting campaign.
Open original ↗

Organisations named here

  • Dark Web Informer
  • Shai-Hulud

Technologies named here

  • Shai-Hulud
  • npm
  • PyPI
  • Packagist
  • GitHub Actions
  • Docker images
  • OpenVSX extensions
  • Open VSX
  • Docker
  • Socket

Techniques named here

  • Supply chain compromise of open source packages
  • Targeting security tools with built-in privileged access
  • Public recruitment via contest/leaderboard

Threat actors named here

  • TeamPCP
  • Shai-Hulud
  • BreachForums
  • Vect
  • ShinyHunters
  • Lapsus$

Related in Supply Chain