TeamPCP Arrests and PolinRider’s Persistent Reinfections Lead OpenSourceMalware Show #19
Summary
The show covers arrests of two TeamPCP-linked suspects in Australia and PolinRider’s ongoing reinfection of developers through persistent malware, compromised npm tooling and poisoned package releases.
Key points
- Australian authorities arrested two suspects linked to TeamPCP; the episode discusses their poor OPSEC and potential further law-enforcement action.
- The hosts describe PolinRider infections persisting on developers’ machines and contaminating packages they publish through legitimate workflows.
- Removing malicious payload files alone may not stop reinfection if persistence mechanisms, the RAT or other malware remain on the machine.
- A newly reported persistence method replaces the npm CLI with a malicious version that can restart the infection when npm runs.
- PolinRider’s injection targets have expanded to additional JavaScript and TypeScript files, including files used in project execution.
- The hosts urge infected developers to investigate thoroughly and notify collaborators, since undisclosed infections can spread or reinfect shared projects.
Article Details
- Event Type
- Arrests of two people associated with TeamPCP, alongside reporting on the ongoing PolinRider malware campaign.
- Impact
- Australian Federal Police and the FBI arrested Ruben Thomson and Louis Gaebler on TeamPCP-related charges. Separately, PolinRider persistence on compromised developer machines has enabled renewed infections and the spread of malicious payloads into repositories and published packages, creating risk for collaborators and users.
People
Brian KrebsJournalist whose reporting on the TeamPCP suspects’ operational-security failures was discussed.DiogoCompromised developer and maintainer whose repositories and npm packages were described as carrying PolinRider payloads.Jenn GileOpenSourceMalware Show host discussing the TeamPCP arrests and PolinRider research.Louis GaeblerOne of two people arrested in Perth on TeamPCP-related charges.Paul McCartyOpenSourceMalware Show host discussing the TeamPCP arrests and PolinRider research.Ruben ThomsonOne of two people arrested in Perth on TeamPCP-related charges.
Threat Actors
Malware
NullReceiverPaul and Jenn cover what’s changed in the kill chain: a new NullReceiver-branded payload, a persistence technique that overwrites the npm CLI binary itself so simply removing payloads from repos isn’t sufficient, and anPolinRiderPolinRider’s persistence outlasts partial remediation — A look at how DPRK’s PolinRider campaign continues to reinfect developers who believed they’d already cleaned up.
Products
GitHubthat we did with, with Akito and Saka and all those guys. The fact is that we all, many of us use GitHub Actions every day, or the equivalent, just to be clear.GitHub Actionsthat we did with, with Akito and Saka and all those guys. The fact is that we all, many of us use GitHub Actions every day, or the equivalent, just to be clear.npmchanged in the kill chain: a new NullReceiver-branded payload, a persistence technique that overwrites the npm CLI binary itself so simply removing payloads from repos isn’t sufficient, and an expanding target list ofPyPIsmattering of PolinRider in Go packages, because Go doesn’t have a- an additional publish step like NPM or PyPi does. But we are now seeing PolinRider in PyPi, we’re seeing it in NPM, we’re seeing it in VS Code, we’reVS CodeNPM or PyPi does. But we are now seeing PolinRider in PyPi, we’re seeing it in NPM, we’re seeing it in VS Code, we’re seeing it in other places. As these developers, you know, go about their daily business and they