TeamPCP Compromised More Than 1,000 Open-Source Packages in Four Months
Summary
Researchers report that TeamPCP compromised more than 1,000 open-source packages in under four months, abusing CI/CD workflows to steal credentials and spread malware. Mini Shai-Hulud’s source code was also released for others to reuse.
Key points
- TeamPCP injected malicious code into more than 1,000 packages in less than four months; the campaign began with Trivy in February.
- The group targets CI runners and repositories, allowing malicious code to reach developers and downstream users who automatically pull updates.
- Researchers say the campaign steals Kubernetes and cloud credentials and has used JavaScript and Python payloads, as well as custom protocols.
- The compromised packages account for about 500 million combined weekly downloads, a measure of potential exposure rather than confirmed infections.
- Some compromised packages remained available for nearly 13 hours; researchers said some affected repositories are now identified and removed within 15 minutes.
- Mini Shai-Hulud infected hundreds of packages, and a TeamPCP affiliate published its source code and encouraged others to use it.
- Researchers reported recurring infections at some victims, in part because compromised secrets were not properly rotated.
Article Details
- Event Type
- Open-source software supply-chain campaign involving malicious code injected into software packages and repositories.
- Impact
- TeamPCP is reported to have compromised more than 1,000 packages in less than four months. The campaign has stolen credentials and other sensitive data, including credentials for cloud and Kubernetes environments, and exposed downstream users to potentially infected packages. The compromised packages reportedly account for roughly 500 million weekly downloads combined, though the article notes that potential exposure does not necessarily mean systems were compromised. Quist said TeamPCP claimed more than 10,000 victims and about $90,000 in extortions.
MITRE ATT&CK
People
Amitai CohenWiz attack vector intelligence team head who discussed TeamPCP’s targeting of CI runners and recurring infections linked to inadequate secret rotation.Benjamin ReadWiz director of strategic intelligence who discussed the speed of repository response and TeamPCP’s operational tempo.Feross AboukhadijehSocket founder and CEO who discussed the risks of unvetted open-source dependencies and AI-driven package installation.Kimberly GoodyGoogle Threat Intelligence Group senior manager who discussed TeamPCP’s activity, motivations, and the attribution assessment that the activity may involve one core operator.Nathaniel QuistPalo Alto Networks cloud threat intelligence manager who discussed package-publisher security, the campaign’s impact, and TeamPCP’s claimed victim and extortion figures.
Threat Actors
diencrackedPalo Alto Networks tracks this handle as an additional core member of TeamPCP.ResoluteXBFPalo Alto Networks said TeamPCP’s core manager uses this handle on multiple platforms.ShinigamiPalo Alto Networks tracks this handle as an additional core member of TeamPCP.TeamPCPThe article attributes a campaign of malicious code injection into more than 1,000 software packages, credential theft, and distribution of Mini Shai-Hulud to TeamPCP.
Malware
Vendors
BitwardenVictims and exposed packages included Checkmarx, Bitwarden, GitHub, Red Hat, and others.CheckmarxVictims and exposed packages included Checkmarx, Bitwarden, GitHub, Red Hat, and others.GitHubcredentials and spread malicious code, with impacts tied to packages and projects like Trivy, npm, PyPI, GitHub Actions, and Mini Shai-Hulud.Googleit is really about exploiting third-party trusts that we have,” said Kimberly Goody, senior manager at Google Threat Intelligence Group.Palo Alto Networkspackages to the wider market, according to Nathaniel Quist, manager of cloud threat intelligence at Palo Alto Networks.Red HatVictims and exposed packages included Checkmarx, Bitwarden, GitHub, Red Hat, and others.Socketloop or any kind of sanity check on what these tools are doing,” Feross Aboukhadijeh, founder and CEO at Socket, told CyberScoop.Wizvaluable supply-chain targets for attackers, Amitai Cohen, head of the attack vector intel team at Wiz, explained during a June presentation on TeamPCP at SleuthCon in Arlington, Va.
Products
Amazon Web Servicesinto open-source software for the purpose of stealing credentials for Kubernetes environments, Amazon Web Services, Microsoft Azure, Google Cloud and many other connected services.GitHub Actionsand spread malicious code, with impacts tied to packages and projects like Trivy, npm, PyPI, GitHub Actions, and Mini Shai-Hulud.Google Cloudthe purpose of stealing credentials for Kubernetes environments, Amazon Web Services, Microsoft Azure, Google Cloud and many other connected services.KubernetesIt targeted developer tools and repositories to steal cloud and Kubernetes credentials.Microsoft Azuresoftware for the purpose of stealing credentials for Kubernetes environments, Amazon Web Services, Microsoft Azure, Google Cloud and many other connected services.npmto steal credentials and spread malicious code, with impacts tied to packages and projects like Trivy, npm, PyPI, GitHub Actions, and Mini Shai-Hulud.PyPIsteal credentials and spread malicious code, with impacts tied to packages and projects like Trivy, npm, PyPI, GitHub Actions, and Mini Shai-Hulud.Trivytools to steal credentials and spread malicious code, with impacts tied to packages and projects like Trivy, npm, PyPI, GitHub Actions, and Mini Shai-Hulud.
Countries
Industries
CybersecurityThe cybersecurity firm is also tracking two additional core members: “diencracked” and “Shinigami.”Software developmentcode they ingest into their systems is legitimate, abusing a nearly blind faith that much of the software development industry relies on to power today’s modern economy.