Two Australians Charged Over TeamPCP, the Crew That Chained One Stolen Token Into a Supply-Chain Crisis
From a Trivy scanner compromise in March to an August arrest, the TeamPCP campaign showed how stolen CI credentials cascade across five software ecosystems.
Key takeaways
- Australian police charged two Western Australian men, 21 and 23, with 14 offences combined on 26 August 2026; the charges are unproven.
- Investigators estimate over 500,000 credentials were stolen and more than 1,000 organisations may have been affected.
- The campaign spread across GitHub Actions, Docker Hub, npm, PyPI and OpenVSX using credentials harvested from earlier victims.
On 26 August 2026 the Australian Federal Police charged two Western Australian men over TeamPCP, the group blamed for a months-long run of software supply-chain compromises that began with a security scanner and ended up inside some of the industry's best-known companies. The FBI assisted, and described one of the pair as the alleged leader.
The arrests
Police searched properties in Cottesloe, Hamilton Hill and Mandurah and seized devices. Ruben Ian Thomson, 21, faces eight charges, including dealing with criminal proceeds of at least A$100,000 and failing to comply with a data-access order. Louis Michael Gaebler, 23, faces six. Both appeared in Perth Magistrates Court on 27 August. Everything here is allegation; nothing has been tested at trial.
Investigative estimates put the campaign's reach at more than 1,000 government, academic and private organisations, over 500,000 stolen credentials and at least 300GB of data, with remediation costs in the hundreds of millions of dollars. Police reportedly extracted about 100TB from devices at one address.
How one token became a cascade
Researchers trace the origin to a misconfigured GitHub Actions workflow in Aqua Security's Trivy repository, which let an automated attacker leak a service-account token in late February. An incomplete credential rotation left some access alive, and poisoned Trivy releases followed in March. Credentials harvested from that compromise were then reused: about four days later, tokens were used to tamper with Checkmarx's GitHub Actions, and reporting says malicious commits were force-pushed into all 35 version tags of the KICS action. Researchers also linked TeamPCP to the Bitwarden CLI package in April, in a chain where a compromised Checkmarx KICS Docker image was pulled by Dependabot in CI.
By May the Mini Shai-Hulud worm had poisoned more than 400 package versions across 172 npm and PyPI packages in about five hours, touching projects tied to TanStack, Mistral AI, UiPath and OpenSearch. TechCrunch's roundup says downstream victims included OpenAI, Vercel and the EU's top cyber agency, which lost cloud keys.
Why it matters
The Trivy episode is a reminder that security tooling is itself a high-value target: it runs with broad access in the build pipeline. The FBI advisory in July warned that stolen credentials stay useful after malicious packages are removed, so cleanup is a rotation job. The case also shows investigators following a supply-chain trail across borders, with cybersecurity firms feeding evidence to the AFP and FBI from April.
Scale, claims and caution
Some of the numbers around TeamPCP are estimates by investigators or researchers, and should be read that way. Separate research linked the LiteLLM incident to possible exposure at more than 2,500 companies and roughly 434,000 CI/CD pipelines, though that does not prove every listed organisation ran the malicious code. The group also claimed to have stolen about 3,800 internal GitHub repositories; GitHub said it found no evidence that customer data or infrastructure outside its internal network was accessed. TeamPCP additionally claimed to be selling Mistral AI repositories, and Mistral confirmed a temporary compromise of one code-management system and access to some non-core repositories.
The malware families named in the FBI's July advisory, including CanisterWorm, SANDCLOCK, Mini Shai-Hulud and Miasma, show how quickly tooling was iterated. Malicious LiteLLM versions 1.82.7 and 1.82.8 and Telnyx Python SDK versions 4.87.1 and 4.87.2 were also uploaded, underlining that the targets were popular libraries with large downstream reach, not obscure packages.
What should defenders take from this? First, a credential that has leaked is not neutralised by deleting the malicious release; every secret exposed to the affected builds must be rotated, and rotation must be complete, since the entire chain began with a partial one. Second, CI workflows should reference third-party actions by immutable commit hash rather than by movable tag, because the KICS incident involved overwriting version tags. Third, automation such as Dependabot is helpful but can also pull in a poisoned image quickly, so cooldown periods before adopting brand-new releases are worth considering. Finally, organisations should inventory which pipelines hold long-lived tokens and replace them with short-lived federated credentials wherever the platform allows.
What to watch
- Court dates in Perth and any US charges or extradition requests.
- Pinning GitHub Actions to commit hashes, which the FBI recommends, and tighter token rotation practices.
- Copycats: the Shai-Hulud family has now produced several variants, and its code is public.
Sources
- Police Arrest Two Alleged TeamPCP Members Linked to Shai-Hulud Attacks — Hackread
- Two Arrested in Australia Over TeamPCP Supply Chain Attacks — eSecurity Planet
- TeamPCP: CI/CD Kill Chain from Trivy to the EU — Cloud Security Alliance
- Leaks, data breaches, and ransom notes: The worst hacks of 2026 so far — TechCrunch
