The Supply Chain Attackers Lived Down the Road

Everything below is sourced. Dates link to the document they come from.

What happened

On 26 August 2026 (6 days ago) the Australian Federal Police and the WA Police Force executed search warrants at three properties — Cottesloe, Hamilton Hill and Mandurah — and seized electronic devices for forensic analysis. The next day two men appeared in Perth Magistrates Court. The ABC named them as Ruben Ian Thomson, 21, of Cottesloe, and Louis Michael Gaebler, 23, of Mandurah. Prosecutors called them the masterminds of TeamPCP. Both are charged, not convicted.

The investigation opened in April 2026, after threat intelligence firms flagged a syndicate inserting malicious code into open-source packages. It ran jointly with the FBI.

The charges

A s.3LA order compels a person to hand over a password or assist in accessing a device. Refusing carries ten years — more than any single charge relating to the attacks themselves.

The 21-year-old's bail application was withdrawn after the magistrate raised concerns about evidence tampering. The 23-year-old made no application and was remanded until 18 September. Investigators have extracted 100 terabytes from the seized devices and expect further arrests.

What TeamPCP allegedly did

This is the part worth reading if you build or buy software. The group did not break into a thousand companies. It broke into a handful of publishers and let the world's build pipelines do the distribution.

The payload was consistent across waves: harvest cloud credentials, Kubernetes tokens, SSH keys and .env secrets; attempt lateral movement across clusters; install a systemd backdoor that polls for more. It moved through five ecosystems — GitHub Actions, Docker Hub, npm, PyPI and OpenVSX.

Two details deserve emphasis.

The first targets were security tools. Trivy and KICS are what you run to check your pipeline is clean. They run early, with broad read access, on every build. SANS called it weaponising the protectors. A scanner is an excellent place to hide, because nobody audits the auditor.

Each compromise funded the next. Credentials stolen from Trivy opened LiteLLM five days later. That is the structural problem with a build pipeline that holds long-lived tokens: one poisoned dependency does not just breach you, it converts you into the next distribution channel.

The numbers, and who they hit

Per the AFP, FBI and vendor telemetry:

• 1,000+ organisations potentially compromised worldwide
• 500,000+ credentials stolen
• 300+ GB of data exfiltrated; 16 victims published on a leak site
• Affected CI platforms, per StepSecurity's analysis: GitLab 1,064 organisations, GitHub Actions 618, Azure DevOps 233, Jenkins 105, Bitbucket Pipelines 94, CircleCI 15
• The August npm wave alone touched package versions representing roughly 2 billion monthly downloads

Named victims reported so far include OpenAI, the AI recruitment firm Mercor, and European Commission cloud infrastructure. Oligo Security traced the group's infrastructure back to 2020.

Why the postcode matters

The comfortable story about cybercrime is that it happens somewhere else, to someone with more to steal, by people you will never meet. This one was allegedly run from Cottesloe and Mandurah by two men in their early twenties, and it reached the European Commission.

WA Police Acting Commander Peter Foley said it plainly:

"It shows the prevalence of cybercrime in our community and that cybercriminals live amongst us."

AFP Commander Graeme Marshall added that it is rare to have cybercriminals of this calibre domestically, and that the ages involved are "unfortunate, but not unusual."

There is no comfort in the geography, and no extra threat in it either. The point is narrower and more useful: this was not a nation-state, a zero-day budget or a targeted campaign against your business. It was two people, ordinary tooling, and the assumption — held almost universally, including by us until we go and check — that a package resolving to a floating version tag will be the same package tomorrow.

What this actually asks of you

Nothing here needs a security program. Most of it is an afternoon.

Check your lockfiles. Start with whether you were exposed at all. I ran this against this website while writing the post:

npm ls keyv cacheable flat-cache file-entry-cache cache-manager
# └── (empty)

Clean, in this repo. file-entry-cache and flat-cache ship as transitive dependencies of ESLint, so a lot of front-end projects are not. Do the same for trivy in your CI images and litellm==1.82.7 or 1.82.8 in your Python requirements.

Pin to hashes, not tags. The FBI's own advice after these charges was to pin GitHub Actions workflows to a verified commit SHA rather than a floating version tag. uses: some/action@v4 re-resolves on every run; uses: some/action@a1b2c3… does not. Same principle in composer.lock, package-lock.json and pinned Docker digests. This is the single change with the best ratio of effort to protection.

Rotate the credentials your pipeline holds, then reduce them. Publishing tokens, cloud keys, deploy secrets. Rotation is the response to this incident; the durable fix is short-lived, scoped credentials — OIDC to your cloud instead of a stored access key — so a poisoned build step gets minutes of narrow access rather than a permanent key.

Assume the build environment is hostile. A CI runner that can reach your production database, your S3 buckets and the open internet is an excellent place for someone else's code to land. Least privilege and network egress control did more to limit this campaign than any scanner.

If you buy software rather than build it, ask two questions. Ask your vendor whether their dependencies are pinned by hash, and how quickly they can tell you which third-party packages are in the product you bought. A vendor who cannot answer the second question inside a day does not have a software bill of materials, and will not be able to tell you whether you were affected by the next one of these either.

Where the Essential Eight lands

If you are working towards the Essential Eight, this campaign sits mostly in patch applications and restrict administrative privileges — and it exposes the limits of both. Patching assumes the new version is safer than the old one. Here the new version was the attack: teams who patched Trivy promptly in March were the ones who got the backdoor. Application control and least privilege held up better, because they constrain what the code can do regardless of where it came from.

That is not an argument against patching. It is an argument that "keep everything current" is not a security strategy on its own, and that the supply chain needs its own control — provenance — which the Essential Eight does not really cover. We wrote about the maturity model's evolution and about what the ASD's own numbers say if you want the wider frame.

The uncomfortable version

Six weeks ago we wrote about AI agents that broke out of a sandbox and compromised Hugging Face on their own, without an attacker. Every entry point in that incident was ordinary: a default API key, an unauthenticated endpoint, over-permissioned service accounts, a published kernel bug.

This story has the same shape from the other direction. Two people, in Perth, using stolen publishing tokens and floating version tags. The entry points were ordinary again.

The pattern in both is that the exotic part is never the way in. It is always a credential that lived too long, a permission nobody scoped, or a version number that meant less than everyone assumed.

If you want a second pair of eyes on what your build pipeline can reach, that is a conversation we are happy to have.

Photo credits. The two diagrams in this post are our own work. The header photograph is used under the Unsplash License — free for commercial use, attribution appreciated:

• Container cranes at Fremantle Port from Port Beach — Corey Serravite

Sources

The charges

• Two WA men charged following AFP-FBI-WAPF disruption of alleged global cybercrime syndicate — Australian Federal Police, 27 August 2026. Charge lists, maximum penalties, warrant locations and both official quotes.
• Two Perth hackers charged after major AFP, FBI investigation — ABC News. Names, court proceedings, bail, the 100TB figure.
• Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks — The Hacker News. The FBI's remediation advice and the campaign timeline.
• Shai-Hulud hackers: two men charged over TeamPCP's global supply chain crime spree — Bitdefender. Named victims.

The attacks

• Weaponizing the Protectors: TeamPCP's Multi-Stage Supply Chain Attack on Security Infrastructure — Unit 42, Palo Alto Networks
• When the Security Scanner Became the Weapon — SANS Institute
• Guidance for detecting, investigating, and defending against the Trivy supply chain compromise — Microsoft Security
• TeamPCP Isn't Done: now hits LiteLLM's 95 million monthly downloads on PyPI — Endor Labs
• Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages — Elastic Security Labs
• ChainDrop npm Worm — StepSecurity. The affected-platform counts.
• keyv and cacheable npm Package Hijacked in Supply Chain Attack — Wiz