Backdoored Cemu Linux Releases Linked to TeamPCP Supply-Chain Campaign
Summary
Researchers found malicious Linux assets on Cemu’s official v2.6 GitHub release page, containing a payload also linked to compromised npm and PyPI packages. The malware harvests credentials and exfiltrates data; maintainers confirmed a co-author’s account or token was|?
Key points
- A campaign poisoned 170 npm and PyPI packages within five hours, including TanStack and Mistral releases.
- Two malicious Linux assets were uploaded to Cemu’s official v2.6 GitHub release page by a long-term co-author’s account; maintainers said the account or token was compromised.
- The AppImage had nearly 19,900 downloads before discovery. Researchers found no related tag change, main-branch commits, workflow edits, or release deployment runs.
- Both Linux packages contained a Python payload matching one distributed in the broader campaign; the Ubuntu version uses a marker-file gate that delays execution until a later run.
- The Linux-only payload can persist as a systemd service and harvest cloud, Kubernetes, SSH, GitHub, and password-manager credentials.
- The malware exfiltrates through a C2 server, a GitHub-commit dead drop, or a repository created under the victim’s account. Its destructive behavior is geofenced to Israel and Iran.
- TeamPCP claimed responsibility, but researchers said they could not assess the claim’s credibility.
Article Details
- Attack Vectors
- Compromised npm publishing tokens were used to publish malicious versions of legitimate packages, including @tanstack/react-router.
- A backdoored mistralai==2.4.6 package was published to PyPI.
- A compromised Cemu co-author account or token was used to replace Linux assets on the legitimate Cemu v2.6 GitHub release page.
- The payload harvests credentials and secrets from AWS, Azure, GCP, Kubernetes, local filesystems, SSH keys, GitHub tokens, and password managers.
- The payload exfiltrates results to a C2 IP, then attempts a GitHub-commit dead-drop resolver, and finally can create a public repository under the victim's account to upload results.
- Defensive Notes
- Check systems for the listed payload and release-asset SHA-256 indicators.
- Investigate suspicious Linux Cemu v2.6 assets and activity from the compromised MangelSpec account or token.
- Hunt for C2 traffic to 83[.]142.209[.]194 and for follow-on GitHub activity involving repositories created under victim accounts.
- The article reports that the destructive rm -rf / command may not execute successfully on modern Linux systems without --no-preserve-root; a later variant used rm -rf /*.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 83[.]142[.]209[.]194 | C2 server used for the payload's primary exfiltration attempt. |
| SHA256 | 0f35abda19fb69430c32228465396094b866d887427bf551e353ab31256a9dd6 | SHA-256 of the backdoored startup.pyz/transformers.pyz payload included in the Cemu AppImage. |
| SHA256 | 1bf72f05191d849049d4a38fced2277ac5cfc54b7ae591f564e7a14add7c886d | SHA-256 of the backdoored startup.pyz included in the Ubuntu Cemu archive. |
| SHA256 | d07a29c4458d00e42d5d9e6345932592e91644d6b821bacdb7a543c628e0b41a | SHA-256 of the malicious Cemu-2.6-x86_64.AppImage release asset. |
| SHA256 | f140e76236b96adf7cdc796227af9808665143bc674debb77729fa3e4b8327cc | SHA-256 of the malicious Cemu-2.6-ubuntu-22.04-x64.zip release asset. |
MITRE ATT&CK
T1195.002 · Compromise Software Supply ChainMalicious package versions and backdoored Cemu release assets were distributed through compromised publishing credentials and a compromised repository account.T1490 · Inhibit System RecoveryFor systems geolocating to Israel or Iran, the destructive component may delete host files using rm -rf /; the article notes that this command may fail on modern Linux without --no-preserve-root.T1543.002 · Systemd ServiceThe payload persists by installing pgmonitor.py as the systemd service pgsql-monitor.service.T1555 · Credentials from Password StoresThe payload collects credentials and secrets from cloud secret stores, Kubernetes, filesystem credentials, SSH keys, GitHub tokens, and password managers.T1567.004 · Exfiltration Over WebhookWhen other network paths fail, the payload can upload results.json to a newly created public GitHub repository under the victim's account.
People
Threat Actors
Vendors
Products
1Passwordall namespaces, and filesystem credentials including SSH keys, GitHub tokens and password managers (1Password, Bitwarden, gopass, pass).AWS2026-05-06 21:22:46 ..... 7274 1953 python_mistral_cemu_files/collectors/aws.pyAzure2026-05-03 04:24:58 ..... 7803 2178 python_mistral_cemu_files/collectors/azure.pyBitwardenand filesystem credentials including SSH keys, GitHub tokens and password managers (1Password, Bitwarden, gopass, pass).Cemuthat transformers.pyz a payload embedded in the malicious wheel was also associated with releases on the cemu-project/Cemu GitHub release page, a Nintendo Wii U emulator with no obvious relationship to Python ML SDKs.GCP2026-05-03 04:24:58 ..... 6370 1891 python_mistral_cemu_files/collectors/gcp.pyKubernetes2026-05-05 04:21:48 ..... 11943 3172 python_mistral_cemu_files/collectors/kubernetes.pyMistralThe Datadog Security Research Feed showing affected packages from the TeamPCP supply chain campaign, including the TanStack and Mistral compromisesTanStackSafeDep documented the notable victims, malicious versions of @tanstack/react-router (3M+ weekly downloads) pushed through compromised npm tokens alongside a direct commit to the upstream GitHub repo (79ac49eed), and a
Countries
IranA geofenced destructive component also exists: systems geolocating to Israel or Iran have a 1-in-6 chance of triggering forced audio playback and deleting files from the host's filesystem with rm -rf /.IsraelA geofenced destructive component also exists: systems geolocating to Israel or Iran have a 1-in-6 chance of triggering forced audio playback and deleting files from the host's filesystem with rm -rf /.