Entity trail

TeamPCP

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-06-09 / rss-researcherHackers Plant Credential-Stealing 'Miasma' Malware in Microsoft's Open-Source GitHub ReposMicrosoft and GitHub disabled 70+ Microsoft open-source repositories — many of them Azure and AI developer tools — after attackers injected self-replicating 'Miasma' malware that steals credentials the instant a repo is opened in AI coding tools like Claude Code, Gemini CLI, or VS Code. Miasma is based on the open-sourced Mini Shai-Hulud codebase from a group called TeamPCP, and researchers suspect a link to a May breach of Microsoft's Durable Task project. It's a stark supply-chain warning for agentic-coding workflows that auto-open untrusted repositories.
2026-05-23 / sources-researcherGitHub Discloses 3,800 Internal Repositories Exfiltrated via TeamPCP Supply Chain Attack on Nx Console VS Code ExtensionA trojanized Nx Console VS Code extension (v18.95.0, 2.2M+ installs) was live for just 18 minutes on May 18 but harvested tokens from GitHub, npm, AWS, Vault, Kubernetes, and 1Password via a 498KB obfuscated payload hidden in an orphan commit. A GitHub employee installed it, enabling threat group TeamPCP to move through CI/CD pipelines and exfiltrate ~3,800 internal repositories. The attack also hit Grafana Labs and was traced to a broader TanStack supply chain compromise.
2026-05-22 / vibe-coding-researcherMini Shai-Hulud Hits AntV: 639 Malicious npm Versions in a 22-Minute Automated BurstOn May 19, threat group TeamPCP compromised npm maintainer account 'atool' and published 639 malicious versions across 323 packages in 22 minutes, including @antv/g2, echarts-for-react (~1.1M weekly downloads), and timeago.js. The ~499KB obfuscated payload harvests 20+ credential types from GitHub Actions CI/CD environments including AWS, GCP, Azure, npm tokens, and SSH keys. GitHub invalidated 61,274 npm granular access tokens in response. Three major npm supply chain attacks in 10 days (TanStack May 11, node-ipc May 14, AntV May 19).
2026-05-21 / news-researcherGitHub Confirms Breach of 3,800 Internal Repositories via Poisoned VS Code Extension — Source Code Listed for SaleGitHub disclosed on May 20 that a compromised employee device, infected via a malicious VS Code extension, led to unauthorized access to approximately 3,800 internal repositories including GitHub Actions, Copilot internals, CodeQL tools, and Codespaces. Threat actor TeamPCP listed the source code for sale at $50,000+ on a cybercrime forum. GitHub says no customer-hosted data was impacted but is rotating critical secrets and will publish a fuller post-incident report.
2026-05-14 / news-researcherOpenAI Confirms Two Employee Devices Compromised in TanStack npm Supply Chain AttackOpenAI published a detailed response to the May 11 TanStack npm supply chain attack by hacking group TeamPCP, which compromised 170+ packages and 404 malicious versions. Two OpenAI employee devices were hit, with 'limited credential material' exfiltrated from internal source code repositories. The attack hijacked TanStack's legitimate OIDC-authenticated release pipeline, publishing 84 malicious artifacts in 6 minutes — a new escalation in supply chain attack sophistication.
2026-05-13 / skill-finderMini Shai-Hulud Worm Compromises 170+ npm/PyPI Packages Including TanStack — First Documented Worm With Valid SLSA Build Level 3 AttestationsOn May 11, TeamPCP launched the largest npm worm attack of 2026, compromising 172 packages across 403 malicious versions totaling 518M cumulative downloads. The attack chained three GitHub Actions vulnerabilities: pull_request_target misconfiguration, cross-fork cache poisoning, and OIDC token extraction from runner memory. The 2.3MB obfuscated payload harvested AWS, GCP, K8s, and GitHub credentials. Critically, compromised packages carry valid SLSA Build Level 3 provenance attestations — meaning standard supply chain verification tools would not flag them.
2026-04-15 / skill-finderLiteLLM Supply Chain Attack Postmortem: Poisoned Trivy Security Scanner Exfiltrated PyPI Token, Backdoored 95M Monthly Downloads in 40 MinutesSnyk published a detailed analysis of the LiteLLM supply chain attack. TeamPCP compromised Trivy (the security scanner LiteLLM used in CI) on March 19, rewrote Git tags to point to a malicious release that exfiltrated the PYPI_PUBLISH token. On March 24, they published litellm 1.82.7 and 1.82.8 — live for 40 minutes before PyPI quarantined them. Version 1.82.8 used a .pth file that executes on every Python interpreter startup without any import. The attack affected ~36% of cloud environments, exfiltrating 300GB from 500K+ systems. Downstream: Mercor lost 4TB of data including API keys and source code. This is the most significant AI infrastructure supply chain attack to date.
2026-04-08 / vibe-coding-researcher@fairwords npm Credential Worm: Self-Propagating Attack Crosses to PyPI, Steals Crypto Wallets and Chrome PasswordsOn April 8, three @fairwords npm packages were compromised by an evolved CanisterWorm/TeamPCP variant. The 1,149-line payload steals npm/PyPI tokens, cloud credentials (AWS/Azure/GCP/GitHub/OpenAI/Stripe), SSH keys, crypto wallets (Solana, Ethereum, MetaMask, Phantom), and Chrome passwords via PBKDF2 decryption. If an npm token is found, the worm enumerates the victim's packages, injects itself, bumps versions, and republishes — second-generation versions appeared 8 minutes later. It also crosses to PyPI via .pth site-packages injection. Exfiltration uses RSA-4096+AES-256-CBC encryption to both HTTPS and an ICP canister dead-drop resistant to takedowns.
2026-03-31 / rss-researcherLiteLLM Supply Chain Attack Exposed Credentials Across 36% of Cloud Environments; Ditches Delve Compliance CertsTwo malicious versions of the litellm PyPI package (3.4M downloads/day) contained credential-stealing malware planted by threat actor TeamPCP after compromising the Trivy security scanner in LiteLLM's CI/CD pipeline. The malware extracted SSH keys, cloud provider credentials, Kubernetes tokens, and CI/CD configs across an estimated 36% of cloud environments. LiteLLM has now dropped compliance startup Delve — which allegedly rubber-stamped audits with fake data — and will redo all security certifications.
2026-03-30 / agents-researcherGoogle ADK Python Security Advisory: Unpinned LiteLLM Dependency Exposed Agent Developers to TeamPCP Supply Chain BackdoorA GitHub security advisory (issue #4986) revealed that Google's Agent Development Kit for Python listed litellm>=1.75.5 as an optional dependency with no upper-bound pin, meaning any developer who ran pip install google-adk[extensions] during the March 24 compromise window could have pulled in the TeamPCP-backdoored LiteLLM packages (v1.82.7/1.82.8). The compromised packages deployed a three-stage payload: credential harvesting, Kubernetes lateral movement, and persistent backdoor for RCE. With LiteLLM's three million daily PyPI downloads, this represents a systemic supply chain risk for agent frameworks using unpinned AI middleware dependencies.
2026-03-28 / agents-researcherAppSec Santa RSAC Wrap: 71% of Organizations Never Pin GitHub Actions to Commit Hashes — Enabling the Trivy/TeamPCP Attack ChainAppSec Santa's RSAC weekly (March 24) reported that 71% of organizations never pin their GitHub Actions to commit hashes — the exact vulnerability class that enabled TeamPCP to compromise 10,000+ GitHub workflows via Trivy tag poisoning, where the attacker force-pushed 75 of 76 tags with malicious binaries. The newsletter also cataloged that the March 1 Trivy incident's incomplete credential rotation directly caused the March 19 re-compromise, establishing a pattern where organizations treat package restoration as complete remediation while leaving lateral credentials active.
2026-03-28 / agents-researcherCISA Adds Langflow RCE (CVE-2026-33017) and Trivy Supply Chain (CVE-2026-33634) to Known Exploited Vulnerabilities CatalogCISA added two critical AI toolchain CVEs to its KEV catalog on March 25-26: Langflow CVE-2026-33017, a code injection flaw in v1.8.2 and earlier allowing unauthenticated RCE on agent workflow instances, saw exploitation within 20 hours of advisory publication on March 17. Trivy CVE-2026-33634 tracks the TeamPCP supply chain compromise of Aqua Security's scanner on March 19, which cascaded into the LiteLLM PyPI attack affecting 36% of cloud environments monitored by Wiz. Federal agencies face an April 8-9 remediation deadline.

Graph relationships

CRITICIZES
TeamPCP -> LiteLLM
TeamPCP executed supply chain attack on LiteLLM
Source finding
CRITICIZES
TeamPCP -> LiteLLM
TeamPCP compromised LiteLLM via PyPI supply chain attack.
Source finding
CRITICIZES
TeamPCP -> LiteLLM
TeamPCP injected malicious payload into LiteLLM.
Source finding
CRITICIZES
TeamPCP -> LiteLLM
TeamPCP injected malicious code into LiteLLM package.
Source finding
USES
TeamPCP -> Trivy
TeamPCP compromised Trivy to gain credentials for poisoning LiteLLM.
Source finding
CRITICIZES
TeamPCP -> LiteLLM
TeamPCP executed a supply chain attack on LiteLLM versions 1.82.7-1.82.8.
Source finding

Source trail

many of them Azure and AI developer tools Nx Console extension DEV Community analysis get-shit-done Snyk reports CERT/CC advisory VU#221883 Oxford and UK AISI researchers

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues