On August 26, 2026, Australian Federal Police arrested Ruben Ian Thomson and Louis Michael Gaebler, alleged leaders of TeamPCP, a cybercrime group that compromised over 1,000 organizations through software supply chain attacks. This campaign exposed more than 500,000 credentials and led to global remediation costs in the hundreds of millions of dollars. While prosecutors called them the "masterminds" of the operation, their arrests won't eliminate the systemic vulnerabilities they exploited in your development pipelines.
The Attack Unveiled
TeamPCP targeted open-source software and automation tools used daily by development teams. They exploited a misconfigured GitHub Actions workflow in Aqua Security's Trivy vulnerability scanner in February, stealing a Non-Person Entity token. Even after credential rotation, attackers maintained access and pushed malicious Trivy releases through multiple distribution channels in March.
The compromised software installed credential-stealing code inside automated development pipelines. The stolen Trivy access allowed attackers to release backdoored versions of the LiteLLM AI proxy library. A May campaign affected over 170 packages with nearly 180 million combined weekly downloads, targeting software from TanStack, Mistral AI, UiPath, and OpenSearch.
The malware searched developer environments for cloud credentials, API keys, Kubernetes tokens, cryptocurrency wallets, and other authentication materials. Some variants included data-wiping functionality. TeamPCP also claimed responsibility for stealing roughly 3,800 internal GitHub repositories after a developer used a compromised VS Code script.
Threat intelligence firm Flare identified Thomson by tracing the alias DeadCatx3 across bug bounty programs, social media, gaming platforms, and developer accounts. The alias linked to a domain serving as command-and-control infrastructure for Mini Shai-Hulud, a self-replicating worm that moved between npm and PyPI repositories by stealing credentials from compromised packages.
Timeline of Events
Late February 2026: Attackers exploit misconfigured GitHub Actions workflow in Trivy vulnerability scanner, stealing a Non-Person Entity token.
March 2026: Despite credential rotation, attackers push malicious Trivy releases through multiple distribution channels; steal LiteLLM publishing token.
April 2026: Australian Federal Police and FBI begin a joint investigation after receiving information about TeamPCP.
May 2026: Mini Shai-Hulud campaign compromises over 170 packages with nearly 180 million combined weekly downloads.
July 2026: FBI issues advisory on supply chain security practices.
August 26, 2026: Australian Federal Police arrest Thomson and Gaebler in Western Australia.
Thomson faces eight charges, including unauthorized modification of data and dealing in criminal proceeds valued at 100,000 Australian dollars or more. Gaebler faces six related charges. Investigators indicated additional arrests remain possible.
Controls That Failed
SC-7 (Boundary Protection): Organizations failed to monitor development pipelines for unexpected outbound connections. The malware exfiltrated credentials and data without triggering alerts.
IA-5 (Authenticator Management): Non-Person Entity tokens and publishing credentials lacked appropriate lifecycle controls. Attackers retained access after initial credential rotation because organizations didn't scope tokens narrowly or implement short lifespans.
CM-3 (Configuration Change Control): Misconfigured GitHub Actions workflows created the initial entry point. Organizations didn't validate workflow configurations against security baselines before deployment.
SA-10 (Developer Configuration Management): Development environments lacked controls to prevent unauthorized code execution. Compromised packages installed malware in automated build processes without detection.
SI-4 (System Monitoring): Organizations failed to monitor CI/CD pipelines for indicators of compromise. Attackers moved laterally across package repositories and distribution channels without triggering security reviews.
AC-6 (Least Privilege): Publishing tokens and service accounts held excessive privileges. A PyPI token that can publish any package indefinitely converts a single compromise into a supply chain event affecting millions of downstream users.
Standards and Requirements
NIST SP 800-53 Rev 5 control SA-15 (Development Process, Standards, and Tools) requires organizations to document and implement security requirements for development tools and environments. This includes "developer-provided configuration management" and "integrity verification of software and information."
SA-10 (Developer Configuration Management) specifically mandates "automated mechanisms to maintain an up-to-date, complete, accurate, and readily available baseline configuration" and "integrity verification of the information system."
For organizations subject to DFARS 252.204-7012, the flow-down requirements mean your subcontractors' compromised development tools become your compliance problem. When a supplier's compromised package enters your environment, you're responsible for the incident reporting under paragraph (c)(1).
CMMC 2.0 Level 2 practice SC.L2-3.13.1 requires you to "monitor, control, and protect organizational communications at the external boundaries and key internal boundaries of information systems." Your CI/CD pipeline is a key internal boundary. If you're not monitoring it for unexpected outbound connections, you're not meeting the practice.
Actionable Steps
Pin GitHub Actions to verified commit hashes, not tags or branch names. Tags move. Commits don't. This practice prevents attackers from substituting malicious code after you've reviewed a workflow.
Scope publishing tokens narrowly. A token that can publish one package to one repository for 30 days limits blast radius. A token that can publish anything forever creates unlimited exposure. Set token lifespans to match your actual release cadence.
Rotate all credentials after any pipeline compromise, not just the ones you think were accessed. The Trivy case demonstrates that attackers maintain persistence through secondary access paths. Rotation must be comprehensive.
Monitor development environments for authentication materials in memory and on disk. The malware searched for cloud credentials, API keys, and Kubernetes tokens. If those materials exist in your developer workstations or build agents, assume they're exposed.
Review your Software Bill of Materials for the affected packages. If you used Trivy, LiteLLM, or any of the 170 packages compromised in May, you need to verify which versions you deployed and whether they contained malicious code. Your SBOM should make this review possible within hours, not weeks.
Implement monitoring for your domains in credential stealer logs. Flare traced Thomson through reused credentials across multiple platforms. The same credential reuse that enabled threat intelligence also enables lateral movement into your environment. Monitor combolists and stealer logs for your organizational email domains.
Audit your CI/CD configurations against CIS Benchmarks. The misconfigured GitHub Actions workflow that started this campaign represents a preventable configuration error. Automated configuration scanning catches these issues before attackers do.
The arrests show that law enforcement can identify and disrupt specific threat actors. They don't demonstrate that your supply chain is secure. The vulnerabilities TeamPCP exploited, overprivileged tokens, unmonitored pipelines, misconfigured workflows, exist independently of any individual attacker. Your action items don't change because two people are in custody. They change because you now understand how a $100,000 criminal proceeds charge scales to hundreds of millions in global remediation costs.
