TeamPCP Supply-Chain Campaign Targets npm Packages, GitHub Actions and a VSCode Extension
Summary
Wiz researchers detail a TeamPCP-attributed campaign that compromised developer tools to steal credentials, exfiltrate data and install a persistent backdoor. The investigation is ongoing; organizations are advised to check affected components and rotate exposed secrets
Key points
- The campaign affected numerous npm packages, including many in the @antv namespace, two GitHub Actions, and the nrwl.angular-console VSCode extension version 18.95.0.
- Malicious packages retrieved secondary payloads from GitHub-hosted infrastructure; some payloads were stored in orphaned commits.
- The malware stole GitHub tokens, SSH keys, cloud credentials, browser secrets and other developer authentication data, then exfiltrated it through attacker-created public GitHub repositories.
- A Python backdoor at ~/.local/share/kitty/cat.py enabled persistence and could execute remote code following signed GitHub-hosted commands; the associated C2 infrastructure had not been observed active.
- Wiz attributed the activity to TeamPCP with moderate confidence, citing infrastructure, malware, operational and tradecraft overlaps.
- Wiz recommends auditing developer systems and repositories, investigating affected components and suspicious GitHub activity, rotating potentially exposed credentials, and strengthening supply-chain controls.
Article Details
- Attack Vectors
- Malicious npm packages, GitHub Actions, and a compromised VSCode extension introduced a multi-stage infection chain that retrieved additional payloads from GitHub-hosted infrastructure.
- Secondary payloads used bun to execute credential theft and establish persistence, including a Python backdoor at ~/.local/share/kitty/cat.py.
- The backdoor polled GitHub for signed command-and-control messages containing “firedalazer” and retrieved remote Python code from attacker-controlled infrastructure.
- The malware stole developer credentials and secrets and exfiltrated data through attacker-created public GitHub repositories.
- Defensive Notes
- Investigate developer workstations, CI/CD environments, and repositories for compromise; audit for the affected packages, GitHub Actions, and VSCode extension.
- Review GitHub activity for unauthorized repositories, newly created access tokens, and suspicious workflow executions.
- Assume GitHub tokens, SSH keys, cloud credentials, and CI/CD secrets may be exposed, and rotate them.
- Hunt for persistence mechanisms, including ~/.local/share/kitty/cat.py, and unusual outbound GitHub communication.
- Implement dependency allowlisting, SBOM generation, package verification, and improved monitoring of developer and build environments.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | m-kosche[.]com | Identified as backup malware C2. |
| IPV4 | 185[.]95[.]159[.]32 | IP address listed with the backup malware C2 domain. |
| MD5 | b06b126b9e26af03a7ef2f8b8e90d446 | Hash listed for the backdoor stored at ~/.local/share/kitty/cat.py. |
| SHA1 | 783b4019fc5b942a29846132d28441c8fc31bed8 | Hash listed for the backdoor stored at ~/.local/share/kitty/cat.py. |
| SHA256 | fb5c97557230a27460fdab01fafcfabeaa49590bafd5b6ef30501aa9e0a51142 | Hash listed for the backdoor stored at ~/.local/share/kitty/cat.py. |
MITRE ATT&CK
T1102.002 · Bidirectional CommunicationThe backdoor polled GitHub for signed command-and-control messages and retrieved remote code.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious npm packages and a compromised VSCode extension were used to introduce the infection chain.T1543.001 · Launch AgentThe article reports a persistence LaunchAgent plist at ~/Library/LaunchAgents/com.user.kitty-monitor.plist.T1543.002 · Systemd ServiceThe article reports a persistence systemd user service at ~/.config/systemd/user/kitty-monitor.service.T1552.004 · Private KeysThe malware collected SSH keys from infected systems.T1555.003 · Credentials from Web BrowsersThe malware harvested browser-stored secrets from infected systems.T1567.001 · Exfiltration to Code RepositoryStolen data was exfiltrated through attacker-created public GitHub repositories.
Threat Actors
Products
GitHubsupply chain campaign targeting the open source ecosystem reemerged on May 19th, affecting NPM packages, GitHub Actions, and a VSCode extension. The distributed malware was designed to harvest credentials, exfiltrateGitHub Actionschain campaign targeting the open source ecosystem reemerged on May 19th, affecting NPM packages, GitHub Actions, and a VSCode extension. The distributed malware was designed to harvest credentials, exfiltratenpmsoftware supply chain campaign targeting the open source ecosystem reemerged on May 19th, affecting NPM packages, GitHub Actions, and a VSCode extension. The distributed malware was designed to harvestVSCodetargeting the open source ecosystem reemerged on May 19th, affecting NPM packages, GitHub Actions, and a VSCode extension. The distributed malware was designed to harvest credentials, exfiltrate sensitive data, and