Defending against TeamPCP software supply chain attacks | Threat Intelligence

The report describes targeted phishing and credential‑stealing campaigns that compromised npm and PyPI maintainer accounts in 2025, enabling attackers to publish malicious package updates (e.g., replacing cryptocurrency wallets and releasing trojanized packages). It highlights attack vectors including AitM-style phishing and GitHub Actions pull_request_target abuse, documents active exploitation of popular packages, and recommends mitigations such as cooldown windows, SBOMs, dependency audits, SHA pinning for Actions, and phishing‑resistant authentication (passkeys/security keys).