Defending against TeamPCP software supply chain attacks | Threat Intelligence

The report details 2025 supply‑chain attacks in which threat actors used targeted email phishing and Adversary‑in‑the‑Middle (AitM) techniques — and in one case credential‑stealing malware — to compromise npm and PyPI maintainer accounts, create API tokens or update packages, and publish malicious releases that intercepted or redirected cryptocurrency transactions. It highlights the rapid discovery of such malicious updates, the systemic risk to downstream users, and recommends mitigations such as release cooldowns, SBOMs, software composition analysis, GitHub Actions SHA‑pinning, multi-approval merge policies, commit signing, and phishing‑resistant authentication (passkeys/security keys).