🕵️ TeamPCP

The items that name it 64

• The Rise of Agentic Attacks: What They Look Like, and Where They're Headed
  articleas threat actors2026-10-29
• The Rise of Agentic Attacks: What They Look Like, and Where They're Headed
  writeupas threat actors2026-10-29
• The OpenSourceMalware Show #27
  talkas threat actors2026-10-29It is written here as TeamPCP (compromise that started with Trivy and led to LiteLLM's first compromise in March; the page says the October LiteLLM compromise does not appear to be affiliated with them).

  compromise that started with Trivy and led to LiteLLM's first compromise in March; the page says the October LiteLLM compromise does not appear to be affiliated with them

• Muscle AI (@themuscleai) on X
  threadas threat actors2026-10-22It is written here as TeamPCP (campaign in March that hit LiteLLM versions 1.82.7 and 1.82.8).

  campaign in March that hit LiteLLM versions 1.82.7 and 1.82.8

• LiteLLM 1.107.0 PyPI Wheel Contains a Credential Stealer and Persistent Python Backdoor
  writeupas classification.key entities2026-10-21
• LiteLLM supply chain compromise: What you need to know
  writeupas threat actors2026-10-21It is written here as TeamPCP (linked by Datadog Security Research to the earlier 2026 LiteLLM compromise affecting versions 1.82.7 and 1.82.8; no connection to the October 2026 compromise established).

  linked by Datadog Security Research to the earlier 2026 LiteLLM compromise affecting versions 1.82.7 and 1.82.8; no connection to the October 2026 compromise established

• What We Can Learn About GitHub Actions Security from the Trivy Breach | Endor Labs
  articleas classification.key entities2026-10-16
• New research: malware in open source ecosystems surges 14x as attackers hijack trusted packages | Endor Labs
  articleas classification.key entities2026-10-12
• The OpenSourceMalware Show #23
  talkas classification.key entities2026-10-02
• The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
  writeupas classification.key entities2026-09-25
• The OpenSourceMalware Show #22
  talkas threat actors2026-09-25

  Threat actor referenced only for comparison: ShinyHunters' public statement tone/phrasing was said to resemble TeamPCP's from earlier in the year.

• Happy Birthday, Shai-Hulud
  articleas threat actors2026-09-18

  Group that adopted the Shai-Hulud name for 2026 waves, open-sourced a worm framework in May 2026, and ran a contest; two alleged members arrested August 26, 2026; AFP estimated the group enabled theft of more than 500,000 credentials and at least 300GB of data, with remediation costs in the hundreds

• SolarWinds took a nation-state. The next attack just needs an LLM and $5. | Blog | Endor Labs
  articleas threat actors2026-09-11

  Threat actor group that compromised five software supply chain ecosystems in under 30 days in March 2026, starting with an incomplete incident response at Aqua Security in late February, then pivoting to Trivy's GitHub Actions, Docker Hub, npm, OpenVSX, and PyPI; compromised security vendors Aqua an

• The OpenSourceMalware Show #20
  talkas classification.key entities2026-09-09
• GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI
  articleas classification.key entities2026-09-08
• Runtime Security for AWS CodeBuild-Hosted GitHub Actions Runners
  articleas classification.key entities2026-09-02
• Dev Machine Guard Now Inventories Where Developer Credentials Live
  articleas threat actors2026-08-28

  Credential stealer planted in the xinference PyPI package; payload was a flat enumeration of well-known credential paths (~/.npmrc, ~/.pypirc, ~/.vault-token, ~/.netrc, ~/.aws/credentials, ~/.aws/config, ~/.docker/config.json, gcloud application default credentials file, kubeconfig).

• The OpenSourceMalware Show #19
  talkas classification.key entities2026-08-28
• Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps
  articleas threat actors2026-08-27It is written here as TeamPCP (attributed campaigns targeting Version Control Systems).

  attributed campaigns targeting Version Control Systems

• Good riddance, TeamPCP. Now for the hard part.
  articleas threat actors2026-08-27

  Threat group described as not fitting neatly into state actor, organized cybercrime, or ideological categories; mixed money, politics, disruption, ego, and attention-seeking; not especially sophisticated but able to quickly operationalize public exploits, techniques, research, and malware ideas, rep

• Shai-Hulud was the best thing to happen to supply chain security
  articleas threat actors2026-08-24

  Threat actor behind CanisterWorm (Mar 20-21, 2026), CanisterSprawl (Apr 8-22, 2026), Mini Shai-Hulud I (Apr 29-30, 2026, cross-ecosystem attack via compromised CircleCI tokens), and Mini Shai-Hulud II/TanStack (May 7-11, 2026, used a Pwn Request to poison the GitHub Actions cache and extract OIDC to

• The State of Open Source Supply Chain Attacks
  articleas threat actors2026-08-23It is written here as Team PCP.

  Threat actor that ran a five-day campaign, March 19-24, 2026: compromised widely trusted components, planted credential stealers, collected secrets from CI/CD runner memory, and reinvested credentials into further compromises. Per CloudSEK's threat intelligence dataset (published August 2026, analyz

• The OpenSourceMalware Show #18
  talkas classification.key entities2026-08-21
• Team PCP Stole 78,330 Secrets From 2,186 Organizations. CloudSEK Just Published the List.
  articleas threat actors2026-08-15It is written here as Team PCP (also written TeamPCP).

  Threat actor behind a chain of high-profile open source supply chain compromises in 2026; playbook: compromise a widely trusted component, plant a credential stealer, collect secrets loaded into memory by CI/CD runners, reinvest stolen credentials into the next compromise. Exfiltrated 78,330 secrets

• Cloud Threat Highlights: H1 2026
  writeupas threat actors2026-08-06

  Ran the dominant software supply-chain campaign of H1 2026; poisoned npm packages to steal developer credentials and chain into cloud environments; distributed via PyPI starting April-May variant; exploited GitHub Actions CI misconfigurations to poison build caches; extracted OIDC tokens from runner

• keyv and cacheable npm Package Hijacked in Supply Chain Attack
  writeupas threat actors2026-08-04

  Publisher of the public "Mini" Shai-Hulud-Open-Source repositories on which this payload is heavily based; associated with a similar prior supply chain campaign

• The OpenSourceMalware Show #15
  talkas threat actors2026-07-31

  Threat actor described as loud/public and synonymous with account takeovers in the community's attention, contrasted with DPRK's quieter operations; described as 'on the run' at time of recording.

• The OpenSourceMalware Show #14
  talkas threat actors2026-07-23

  Referenced alongside Shai Hulud as using the same net-new-repository exfiltration technique; also mentioned as an example of old code being reused/repurposed.

• OpenSourceMalware Blog
  articleas threat actors2026-07-18

  Threat actor group; members arrested; compromised Bitwarden; compromised npm maintainers atool and prop, republishing 324 packages including the AntV suite across 645 versions; compromised aquasec-com GitHub org (44 repos renamed, internal source code/CI-CD configs/knowledge bases exposed); compromi

• GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps
  articleas threat actors2026-07-12

  Compromised Trivy a second time and hid a credential stealer inside the telnyx PyPI package; harvested secrets from developer machines and CI environments and sent them to attacker-owned infrastructure.

• GitHub Action Canaries
  repoas classification.key entities2026-07-11
• The OpenSourceMalware Show #12
  talkas threat actors2026-07-09

  Threat actor/group that gained access to several thousand GitHub repositories via a malicious Nx console VS Code extension published on both VS Code Marketplace and Open VSX (discussed as prior episode topic).

• The OpenSourceMalware Show #11
  talkas threat actors2026-07-02

  Threat actor/group discussed as subject of an FBI FLASH notice covering their behavior and IOCs; hosts believe possibly a single person operating with additional collaborators ('exploiters and some of the other people'); linked in conversation to DPRK Shi Hulud style attacks as a comparison point, n

• 10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions
  writeupas classification.key entities2026-07-02
• Thinkst Package Proxy
  toolas threat actors2026-06-26

  Threat actor behind a recent round of npm supply-chain package targeting; Package Proxy's age checks prevented impact

• The OpenSourceMalware Show #10
  talkas threat actors2026-06-25It is written here as Team PCP.
• The OpenSourceMalware Show #9
  talkas threat actors2026-06-18

  Threat actor described as sitting on a massive cache of stolen tokens (aging as victims rotate credentials); characterized as going after credentials to pivot into further access.

• Full Fathom Five: The context of Anthropic’s Mythos-class public release
  articleas threat actors2026-06-13It is written here as TeamPCP (named as example of attackers).

  named as example of attackers

• OpenSource Malware: Active Malware Campaigns in January-May 2026
  writeupas classification.key entities2026-06-12
• The OpenSourceMalware Show #8
  talkas threat actors2026-06-11

  Threat actor/group that originally open-sourced the MiniShai Hulud worm, reportedly via a compromised GitHub account.

• Microsoft's durabletask PyPI Package Compromised in Supply Chain Attack
  writeupas threat actors2026-06-09

  Threat group behind the Mini Shai-Hulud campaign; operates secondary C2 domain t.m-kosche[.]com; linked to durabletask attack via shared infrastructure and IOCs (Russian folklore naming, Russian locale exclusion, geopolitically targeted destructive payload)

• Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents
  writeupas classification.key entities2026-06-09
• Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter
  writeupas classification.key entities2026-06-09
• Active Malware Campaigns in January-May 2026
  writeupas classification.key entities2026-06-08
• Miasma Blight Reaches Microsoft: 73 Repos Disabled in 105 Seconds
  writeupas threat actors2026-06-06

  page states 'Whoever held those credentials in May plausibly never fully lost them,' suggesting continued access into June's takedown

• The OpenSourceMalware Show #7
  talkas threat actors2026-06-03

  Threat actor group that open-sourced the MiniShai Hulud worm; has not claimed credit for the Miasma campaign though some researchers (Rami-Mac and others) believe it may be the same threat actor or part of the crew

• The Software Supply Chain Malware Landscape: January - May 2026
  articleas threat actors2026-06-03

  Threat actor behind high-profile account takeovers (ATOs), beginning with the March compromise of Trivy and growing with the Mini Shai-Hulud campaign; attributed to 64% of packages with over 10k weekly downloads and 84% at the 1M+ tier during the surge from late April onward.

• Nx Console VS Code Extension Compromised
  writeupas threat actors2026-06-02
• Orca Security: Red Hat npm Packages Compromised in Supply-Chain Attack Spreading Credential-Stealing Worm
  articleas threat actors2026-06-02It is written here as TeamPCP (or a copycat using their open-sourced Mini Shai-Hulud tooling).

  or a copycat using their open-sourced Mini Shai-Hulud tooling

• Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm
  writeupas threat actors2026-06-01

  Threat actor group running targeted CI/CD supply chain attacks for several months; developed and later open-sourced the Mini Shai-Hulud credential-stealing worm framework on GitHub (May 12, 2026), also posting on BreachForums encouraging others to run their own campaigns

• Miasma: Supply Chain Attack Targeting RedHat npm Packages
  writeupas threat actors2026-06-01

  Threat actor/group behind the open-sourced (Mini) Shai-Hulud malware; observed TTPs consistent with the Miasma campaign, though attribution treated as TTP overlap rather than definitive due to public release of tooling

• Socket: Mini Shai-Hulud
  articleas threat actors2026-05-22

  Group to which the Mini Shai-Hulud campaign is attributed

• Open Source Malware Podcast — episodes
  otheras classification.key entities2026-05-22
• GITHUB LEAK: YOUR CODE @ RISK! – THE RAVEN FILE
  writeupas threat actors2026-05-20
• GitHub breached via a malicious VS Code extension: why developer devices are the real target
  articleas threat actors2026-05-20

  Claims to have extracted data from roughly 4,000 private GitHub repositories

• Socket: TeamPCP + BreachForums Launch $1,000 Contest for Supply Chain Attacks
  articleas threat actors2026-05-20

  Threat actor group promoting Shai-Hulud contest; has been targeting security tools, CI/CD workflows, GitHub Actions, Docker images, OpenVSX extensions, npm, PyPI, and Packagist; releases Shai-Hulud as open source attack tooling; publicly stated: "These companies were built to protect your supply cha

• VSCode Lifecycle Script Malware
  writeupas threat actors2026-05-16

  Threat actor behind Mini Shai-Hulud, a financially-motivated npm worm; copied the tasks.json runOn: folderOpen primitive from PolinRider

• Socket: Bitwarden CLI Compromised in Checkmarx Supply Chain Campaign
  writeupas threat actors2026-05-06

  Group that claimed the Checkmarx attack via the @pcpcats social media account after discovery; malware attempted to blend in with legitimate-looking descriptions

• TeamPCP SAP CAP Attack
  writeupas threat actors2026-05-06
• Mini Shai-Hulud Worm (Apr–May 2026)
  articleas threat actors2026-05-06

  Linked to the SAP CAP and Cloud MTA npm supply-chain campaign reported the day before the intercom-client compromise, based on shared technical details (payload implementation patterns, GitHub-based exfiltration, credential harvesting). Socket is investigating whether intercom-client compromise is p

• Tradecraft Tuesday Recap: axios npm Supply Chain Compromise
  articleas threat actors2026-04-21

  Threat actor that compromised Aqua Security's Trivy vulnerability scanner in March 2026, leading to downstream attacks and later spreading to the npm ecosystem via a worm using stolen publish tokens

• SubQuery npm package (@subql/common) compromised with credential-stealing payload
  articleas threat actors

  Threat actor identified by the page as behind part of the supply chain attack wave, described as having a scalable, repeatable playbook of compromising trusted packages/actions, injecting credential-stealing malware, and reusing stolen credentials to compromise further packages.

• CAIRN — Cisco Talos AI-Malware-Hunting Toolkit
  repoas threat actors

  Backdoored LiteLLM proxy family; archetype A5; documented in docs/families/TEAMPCP.md

• Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages
  articleas threat actors

  Threat actor behind the recent supply chain attack spree, linked to compromise of npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI as part of the Mini Shai-Hulud campaign; assessed to have staged malicious payload via orphaned GitHub fork commit, hijacked TanSta