Two alleged TeamPCP members arrested and charged after months of software supply-chain chaos

Two Australian men were arrested and charged for alleged leadership roles in TeamPCP, a prolific cybercriminal group that injected malicious code into open-source tools and supply chains. The group pushed a tainted Trivy release and a self-replicating infostealer called "mini Shai-Hulud," compromising thousands of organizations, exposing roughly 500,000 credentials, exfiltrating at least 300 GB of data, and causing global remediation costs in the hundreds of millions; law enforcement and private researchers linked online aliases and infrastructure to the suspects but warned the broader threat to open-source supply chains persists.