Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks

The report describes TeamPCP's March 2026 supply-chain compromise that poisoned open-source tools (Trivy, Checkmarx KICS, LiteLLM and others) across GitHub Actions, Docker Hub, npm, PyPI and OpenVSX to steal publishing tokens, CI/CD credentials and exfiltrate data; authorities charged two Australian men in August 2026. Security firms and the FBI estimate widespread exposure (AFP: potentially >1,000 organizations, ~500,000 credentials stolen, ~300 GB exfiltrated; other vendors report even larger reconstructed exposures), trace the group's infrastructure back to earlier activity, and recommend rotating credentials, pinning workflow SHAs, and searching for repo artifacts created by the worm.