Pluto SecurityPluto · Research
2026-06-01

TeamPCP/ UNC6780

The supply chain attack story so far - from a stolen credential in February, through three months of cascade and monetization, to the compromise of GitHub itself. 33 incidents, one criminal ecosystem.

Read the storyEvents breakdownView the chain graphDefender checklistMeet the cast
33
Incidents
Jul 2025 → May 2026
hover for detail
8
Ecosystems hit
npm, PyPI, Actions, ...
hover for detail
~500K
Credentials harvested
self-reported
hover for detail
300+ GB
Data exfiltrated
self-reported
hover for detail
What this is

No single source tells the whole story. Each vendor and independent researcher captures a different slice of it, and the slices don't always agree - dates differ, package counts differ, attributions differ, and disclosures get edited so the contradictions quietly disappear into the diff. Each source also surfaces details no one else captured.

This page is our attempt to pull the field's reporting together for one specific story - the TeamPCP / UNC6780 supply chain campaign - and reconcile it into a single coherent, auditable picture. Every factual claim traces to a citation. Every conflicting date or count between sources is surfaced not buried. Every link in the chain of compromise carries an evidence note and a confidence rating (confirmed / strong / hypothesized). Click any incident node for sources you can audit yourself. For the campaign as one continuous narrative, read the Full Story →

The work is inspired by Rami McCarthy's TeamPCP Incident Timeline ↗ and consolidates and extends excellent prior reporting from across the community. Full attribution catalog ↓

Free, public, updated as new disclosures land. Found an error? Email support@pluto.security or reach Yotam Perkal ↗ directly. Corrections welcome and credited.

The arc, at a glance

Six phases over eleven months

Click any phase to jump to the matching act of the narrative below. For the long-form treatment, read the full story →

  1. Phase 12024 → late 2025
    Origin
    Cryptomining eraPyPI phishing (Jul)npm 2FA-reset (Sep)React2Shell (Dec)
    11 mo
    of capacity-building
  2. Phase 2Feb 20 → Mar 1, 2026
    Recon + Theft
    hackerbot-claw AI agentPR #10252Aqua's non-atomic rotation
    21 days
    of dwell time before the strike
  3. Phase 3Mar 19 → Mar 27
    The Cascade
    Trivy main strikeCanisterWormCheckmarx KICSLiteLLMTelnyxIran wiper
    8 days
    five ecosystems compromised
  4. Phase 4Mar 30 → May 10
    Monetization Pivot
    Vect ransomwareCipherForce coalitionLAPSUS$ collaborationCisco via ShinyHunters
    500K
    credentials → resold to 4 actors
  5. Phase 5May 11 → May 19
    Return + Leak
    Mini Shai-Hulud (TanStack)Source code leaked (May 12)OpenSearch + Mistral@antv mass-republishdurabletask
    170+
    packages in one worm
  6. Phase 6May 18 → 20, 2026
    The GitHub hop
    Nx Console v18.95.0 (May 18)GitHub employee laptop~3,800 internal repos$50K+ on Breached forum
    ~6,000
    dev machines that ran the Nx Console payload
Act 12024 → 2025

The setup

Two years of cryptomining via misconfigured Docker, Kubernetes, Ray and Redis instances let TeamPCP build the credential-harvesting and lateral-movement primitives - 50-plus filesystem paths, IMDS theft, Kubernetes service-account abuse - that would reappear in 2026's supply chain payloads. In mid-December 2025, two months before the Trivy strike, Mario Candela's Beelzebub honeypot captured the operator running an industrial-scale Next.js exploitation campaign whose own C2 stats endpoint reported 59,128 compromises in under 48 hours - the credential pipeline that fed the wave to come.

Act 2Feb 20 - Mar 1, 2026

The opening move

An account called hackerbot-claw scans GitHub for repositories with pull_request_target workflow misconfigurations. On February 27 a user MegaGame10418 exploits the PwnRequest against Trivy and walks out with the aqua-bot PAT. Aqua tries to rotate the token on March 1 - but the rotation is non-atomic, and access persists.

Act 3Mar 19, 17:43 UTC

The breakthrough

TeamPCP force-rewrites nearly all of Trivy's release tags (76 of 77 per SANS and OSM; one dissenting source counts 75 of 76) to point at a 204-line credential stealer GTIG later names SANDCLOCK. Every CI/CD job that pulls Trivy for the next ~12 hours runs the stealer. 474 public repositories executed the malicious action. The tags still pass GitHub's 'Immutable' badge check.

Act 4Mar 19 - Mar 27

The cascade

Stolen npm tokens feed the self-propagating CanisterWorm - 66+ packages, first npm malware to use an ICP blockchain canister as C2. Stolen GitHub PATs hit Checkmarx KICS, OpenVSX extensions, and ast-github-action. Stolen PyPI tokens hit LiteLLM (95M monthly downloads, present in 36% of Wiz-monitored cloud environments). LiteLLM's own CI/CD credentials then hit Telnyx with WAV steganography. An Iran-targeted wiper detonates rm -rf / on standalone hosts.

Act 5Mar 30 - May 10

The pivot

Three days after Telnyx, the pace of new compromises slows. TeamPCP partners with Vect ransomware, the CipherForce coalition, and the LAPSUS$ extortion crew. Stolen credentials flow to ShinyHunters who use them to clone 300+ private Cisco repositories - including AI products and code belonging to bank, BPO, and US-government customers. By month-end Mandiant has documented 1,000+ compromised SaaS environments, projected to grow to 5,000-10,000.

Act 6May 11 - May 19

The return + the leak

Mini Shai-Hulud expands from TanStack (84 versions across 42 packages) to 170 packages across 19 namespaces in two weeks - including AWS-maintained @opensearch-project/opensearch and the Mistral AI clients on both npm and PyPI. On May 12, TeamPCP open-sources their own malware on GitHub ("A Gift From TeamPCP"), lowering the barrier to entry for copycats. By May 18-19, two compromised npm maintainer accounts republish 324 AntV ecosystem packages in two ~6-second automated bursts. Microsoft's durabletask PyPI client falls the same day.

Act 7May 18 - 20, 2026

The GitHub hop

On May 18, a malicious Nx Console v18.95.0 (CVE-2026-48027) goes live on the Visual Studio Marketplace for 18 minutes - long enough for ~6,000 developer machines to install it per Nrwl's analytics. One is a GitHub employee's laptop. The payload harvests cloud and code credentials; the attacker uses the GitHub access to exfiltrate ~3,800 internal repositories and lists them on the Breached forum for $50K+. Per Nrwl's own GHSA advisory, the malicious publish itself was enabled by a Nrwl developer's gh CLI credentials stolen during the May 11 TanStack attack.

Act 8Still unfolding

Still unfolding

The May 21 disclosure closed the immediate chain end-to-end, but it almost certainly isn't the closing chapter. ~6,000 developers ran the Nx Console payload before takedown; each of their machines is now a potential downstream pivot. Stolen credentials don't expire when a story does. An operator interview published by Erez Dasa around the same time included an explicit cessation signal ("my risk/reward ratio tells me my time has come soon to stop operating") - which may or may not be misdirection. Then between May 27 and May 31 the xploitrs spokesperson box turtle (@xploitrsturtle2 on X) ran a public 5-day tease-then-extort sequence against Dynatrace - an initial logo-only teaser on May 27, a partial directory listing on May 29, and a 171,466-file dump with a donate-or-delete extortion attempt on May 31. The X account was suspended later that same day. Whether TeamPCP was involved alongside xploitrs is not yet clear; xploitrs has confessed the three-way 'vect / xploitrs / teampcp' partnership publicly, but also has its own prior solo history (BMW + other car companies). We will continue to update this resource as new findings surface.

The through-line

Six hops: from one stolen token to GitHub

The spine of the campaign. Six events line up end-to-end. The stretched dashed segment in the middle marks the 53-day stretch of cascade and monetization that separates the early-March breakthrough from the May return. Hover any event for detail; click to open sources.

53 dayscascade (Mar 19-27) → monetization → May returnTrivy PwnRequest1Feb 27Malicious PR exploits pull_request_target and walks out with the aqua-bot Personal Access Token.Rotation failure2Mar 1Aqua's PAT rotation is non-atomic. Attacker's session survives the revocation.Trivy main strike3Mar 1976 of 77 release tags force-pushed to a 204-line credential stealer. 12-hour exposure window across 474 repos.TanStack OIDC theft4May 11Cache-poisoning + /proc/<pid>/mem extraction steals OIDC tokens. Worm also harvests downstream maintainers' gh CLI sessions.Nx Console publish5May 18Stolen Nrwl session publishes malicious Nx Console v18.95.0. Live for 18 minutes; ~6,000 dev machines install it.GitHub breach6May 19One affected dev works at GitHub. ~3,800 internal repos exfiltrated; $50K+ on the Breached forum.

Hover any numbered hop for detail. Click to open sources in the incident drawer.

The chain

How one compromise enabled the next

Each row is a package ecosystem. Each arrow is a stolen credential or capability reused. Hover any incident to surface its connected lineage and the evidence on each arrow; hover a node on the spine and the entire through-line surfaces. Click any node for full sources. The red-thickened arrows are the spine; the dashed red segment marks the one hop on the through-line whose connection is TTP-lineage rather than a confirmed stolen credential.

EcosystemGitHub ActionsGitHub (private repos)npmPyPIDocker / container registriesOpenVSXVS Code MarketplaceJenkins MarketplaceCross-cutting2024-25originDec '25React2ShellFeb '26reconMar 19strikeMar 27cascade endsAprpivotMay 20GitHub hop2024-01-01 - Origin: cloud-native cryptomining via misconfigured services2024-01-01Many2025-07-01 - PyPI phishing campaign - num2words compromised, 4 accounts hijacked2025-07-01PyPI maintainers; num…2025-09-01 - npm maintainer compromised via 2FA-reset phishing - 18+ packages poisoned with crypto-wallet stealer2025-09-01unnamed npm maintaine…2025-12-13 - React2Shell: industrial-scale Next.js exploitation campaign (~59K compromises self-reported)2025-12-13React2Shell mass-expl…2026-02-20 - Reconnaissance: hackerbot-claw account scans for vulnerable workflows2026-02-20wide2026-02-27 - First Trivy compromise: aqua-bot PAT exfiltrated via PwnRequest2026-02-27Aqua Security2026-03-01 - Aqua attempts containment - credential rotation incomplete2026-03-01Aqua Security2026-03-19 - Main strike: 76 of 77 trivy-action tags force-pushed (1 dissenting source: 75 of 76)2026-03-19Aqua Security2026-03-19 - Backdoored Trivy v0.69.4 published to GitHub Releases, Docker Hub, GHCR, ECR2026-03-19Aqua Security2026-03-20 - CanisterWorm: self-propagating npm worm hits 47+ packages (66+ ultimately, 141 artifacts)2026-03-20@emilgroup, @opengov,…2026-03-22 - ICP fallback C2 infrastructure deployed (6 songs embedded across 6 endpoints)2026-03-22icp-fallback-deploy2026-03-22 - TeamPCP defaces all 44 repos in aquasec-com GitHub org2026-03-22Aqua Security2026-03-23 - Iran-targeted destructive wiper variant deployed2026-03-23victims with Iran-loc…2026-03-23 - Checkmarx OpenVSX extensions poisoned (ast-results, cx-dev-assist)2026-03-23Checkmarx2026-03-23 - Checkmarx KICS GitHub Action force-pushed (all 35 tags)2026-03-23Checkmarx2026-03-23 - Checkmarx/ast-github-action v2.3.28 reported compromised2026-03-23Checkmarx2026-03-24 - LiteLLM v1.82.7 and v1.82.8 trojanized on PyPI2026-03-24BerriAI / LiteLLM2026-03-27 - Telnyx Python SDK v4.87.1, v4.87.2 trojanized on PyPI (WAV steganography delivery)2026-03-27Telnyx2026-03-30 - Vect ransomware partnership announced; first deployment using TeamPCP credentials2026-03-30unnamed victim2026-03-31 - Suspected TeamPCP pivot to PureHVNC RAT (hunting-level attribution)2026-03-31purehvnc-rat-pivot2026-04-01 - Cisco source code stolen via Trivy-derived credentials (claimed by ShinyHunters)2026-04-01Cisco Systems2026-04-01 - Checkmarx Jenkins AST Plugin compromised (version-impersonation tactic)2026-04-01Checkmarx2026-04-15 - guardrails-ai PyPI compromise (date approximate; Key A payload)2026-04-15Guardrails AI2026-04-23 - @bitwarden/cli@2026.4.0 compromised via CI/CD GitHub Action abuse - payload reads 'Shai-Hulud: The Third Coming'2026-04-23Bitwarden2026-04-29 - First Mini Shai-Hulud wave: 4 SAP CAP packages compromised2026-04-29SAP CAP2026-05-11 - TanStack: 84 malicious versions across 42 packages via OIDC token theft ('Mini Shai-Hulud')2026-05-11TanStack2026-05-12 - TeamPCP open-sources the Shai-Hulud worm - 'A Gift From TeamPCP'2026-05-12shai-hulud-open-sourc…2026-05-14 - TeamPCP + BreachForums announce $1,000 Monero supply chain attack contest2026-05-14breachforums-contest2026-05-18 - Nx Console v18.95.0 compromised (the May 20 GitHub breach vector)2026-05-18Nrwl2026-05-18 - @antv mass-republish wave: maintainers atool + prop hijacked, 324 packages republished as 645 artifacts2026-05-18AntV data-visualizati…2026-05-18 - Microsoft DurableTask PyPI v1.4.1/1.4.2/1.4.3 compromised (8-minute publication window)2026-05-18Microsoft2026-05-19 - GitHub internal-repository breach via poisoned VS Code extension (Nx) on employee device (~3,800 repos)2026-05-19GitHub2026-05-27 - Dynatrace compromise claimed by xploitrs on X (171,466-file internal directory; unverified)2026-05-27Dynatrace
By the numbers

Blast radius, tradecraft, monetization

Below: extended blast-radius numbers (474 repos, 1,705 packages, the 12-hour Trivy exposure window), the new tradecraft each wave introduced, the operator signatures researchers use to tie fresh compromises back to TeamPCP, and the partner ecosystem they monetize through.

474
public repos that ran malicious trivy-action
Cloud Security Alliance
1,705
Python packages that auto-pulled malicious LiteLLM
CSA
36%
of Wiz-monitored cloud environments running LiteLLM
SANS blog citing Wiz Research
~3 h
PyPI quarantine window for LiteLLM after publication
SANS blog
84 / 42
TanStack malicious versions / packages
ThreatLocker
12 h
Trivy main strike exposure window (Mar 19 17:43 → Mar 20 05:40 UTC)
ugurrates
300+
Cisco private repos cloned via Trivy-derived creds
SANS ISC Update 007
161
Sportradar third-party orgs affected
SANS ISC Update 007
~6,000
developer machines that activated the malicious Nx Console v18.95.0 in its 18-minute Marketplace window
Nrwl GHSA-c9j4-9m59-847w

New tradecraft, every wave

Each compromise introduced or refined a technique. The pace of innovation is part of why this campaign matters more than the package count alone.

  1. 2026-03-19Tag hijacking

    Force-pushing release tags to point at imposter commits in GitHub's object store - bypassing 'Immutable' badge.

  2. 2026-03-20ICP-canister C2

    First documented npm malware using an Internet Computer Protocol blockchain canister as C2 - no single takedown point.

  3. 2026-03-22Songs in C2 infra

    Songs literally embedded as labels on C2 endpoints - operator signature unmistakable across waves.

  4. 2026-03-23Locale-gated destruction

    Wiper payload runs `rm -rf /` only on systems with Iran-localized timezone/locale - hybrid financial + geopolitical signal.

  5. 2026-03-27WAV steganography

    Payload hidden inside .wav audio frames; XOR-decrypted to msbuild.exe at install.

  6. 2026-05-11OIDC theft from runner memory

    Extracted OIDC tokens from /proc/<pid>/mem of Runner.Worker via cache-poisoning of GitHub Actions; bypassed SLSA Build Level 3.

  7. 2026-05-11Version-string impersonation

    Republished a plugin with the IDENTICAL version string as a legitimate older release - bypasses naive version-pin checks.

  8. 2026-05-18AWS SSM lateral movement

    Payload propagates to up to 5 cloud machines per infected host via AWS Systems Manager SendCommand.

  9. 2026-05-18Cross-maintainer credential pivot

    Stole a Nrwl developer's gh CLI session (harvested from the May 11 TanStack worm) to publish a malicious Nx Console v18.95.0 to the VS Code Marketplace - first confirmed instance of compromised tooling being used to compromise downstream maintainers' tooling.

  10. 2026-05-19Poisoned VS Code ext on dev endpoint

    An 18-minute Marketplace window was enough - ~6,000 developer machines activated Nx Console v18.95.0 (per Nrwl's analytics), including a GitHub employee's laptop. The payload harvested credentials and the attacker exfiltrated ~3,800 internal GitHub repos.

Operator signatures

The texture that makes TeamPCP recognizable. Researchers can often tie a fresh compromise back to the group within hours using these markers.

Songs embedded in C2 infra

12 tracks

Each C2 endpoint carries a different song. The "Bad Apple!!" track doubles as the anti-sandbox check.

Playlist first catalogued by Rami McCarthy (ramimac.me/teampcp) - timestamps and infrastructure mappings reproduced from his curated timeline.

  1. 01
    Big City Life
    Mattafix
    scan.aquasecurtiy.org
    Primary C2
  2. 02
    Thank You
    Dido
    ICP fallback
    2026-03-22 14:45 UTC
  3. 03
    God Is in the Rhythm
    King Gizzard And The Lizard Wizard
    ICP fallback
    2026-03-22 15:20 UTC
  4. 04
    Except Crime
    YTCracker
    ICP fallback
    2026-03-22 15:57 UTC
  5. 05
    Instant Message
    Yung Innanet
    ICP fallback
    2026-03-22 19:27 UTC
  6. 06
    Teardrop
    Massive Attack
    ICP fallback
    2026-03-22 19:56 UTC
  7. 07
    Drinking
    boa
    ICP fallback
    2026-03-22 20:12 UTC
  8. 08
    The Show Must Go On
    Queen
    checkmarx[.]zone/vsx
    2026-03-23 12:53 UTC
  9. 09
    Bad Apple!!
    Touhou (English Remaster)
    checkmarx[.]zone
    2026-03-24 13:39 UTC
  10. 10
    Mr. Trololo
    Eduard Khil
    nsa[.]cat
  11. 11
    Hello
    Martin Solveig & Dragonette
    git-tanstack[.]com
  12. 12
    Snowblind
    Black Sabbath
    t.m-kosche[.]com
The strongest attribution link
One RSA-4096 public key, reused across payloads.

The same RSA-4096 public key encrypts exfiltration bundles across LiteLLM 1.82.7 and 1.82.8, Telnyx 4.87.1 and 4.87.2, and onward. A second "Key B" appears in durabletask and guardrails-ai - clearly an evolution of the same campaign.

Self-identification string
"TeamPCP Cloud stealer"

Found in the Trivy entrypoint.sh payload. Google GTIG formally names this malware family SANDCLOCK.

The kill switch
If the C2 returns a YouTube link, the backdoor sleeps.

Researcher sandboxes typically hit the C2 from a fresh, unknown IP. TeamPCP returns a link to the "Bad Apple!!" YouTube video to those, and skips execution. The same song appears as the C2 label on checkmarx[.]zone.

Typosquat patterns

Per-wave domains designed to pass a fast log review. Defenders looking at CI logs see "aquasecurtiy.org" and skim past it as the vendor's own domain.

Squat domainImitatesWave
scan.aquasecurtiy[.]orgaquasecurity.orgTrivy
checkmarx[.]zonecheckmarx.comCheckmarx/KICS
models.litellm[.]cloudlitellm.aiLiteLLM PyPI
git-tanstack[.]com(TanStack official infra)TanStack-adjacent
t.m-kosche[.]com(AntV-adjacent)AntV
check.git-service[.]com(GitHub-adjacent)durabletask

The monetization ecosystem

TeamPCP harvests credentials. Other actors operationalize the access. This is the "supply-chain attack as a service" stack emerging on cybercrime forums.

Supplier
TeamPCP
UNC6780 · PCPcat

Compromises supply chains, harvests credentials, then sells or partners access. Three formal partnerships + one cross-actor credential consumer documented to date.

xploitrs

operational-partner group

Separate group from TeamPCP, partnered since the CanisterWorm operation. Per box turtle's April 25 Inside Darknet interview: xploitrs had prior history (hacked BMW + other car companies) and during TeamPCP campaigns handled credential validation, enumeration, and exfiltration. Per the TeamPCP leader's May 9 Inside Darknet interview, xploitrs was the 'good partner' who taught TeamPCP git exploitation and enabled the Aqua/Trivy access pivot. Public confirmation of partnership came from box turtle on X 2026-03-27 - three days before the formal Vect-partnership BreachForums announcement: 'vect / xploitrs / teampcp have all been partnered.'

source

Vect

ransomware-as-a-service

Partnership announced 2026-03-30 on BreachForums; cooled per the May 9 Inside Darknet interview - TeamPCP now runs their own proprietary locker, and box turtle (xploitrs) publicly states 'vect should not have been involved.' Vect 2.0 RaaS has a known broken encryption (any file >128KB is permanently destroyed because decryption nonces overwrite each other; victims who pay cannot recover those files).

source

LAPSUS$

extortion group

SANS blog: 'collaborating with the LAPSUS$ extortion group to target multi-billion-dollar companies.' Role per TeamPCP leader: red/negotiation team to process credentials.

source

ShinyHunters

antagonist (failed partnership)

NOT a formal partner. Per May 9 TeamPCP-leader interview: a ShinyHunters member infiltrated the Vect operator chat, agreed to split profit on a credential bundle, then downloaded the credentials, refused to pay, and released 'a mix of real and fabricated chats' to discredit TeamPCP. Subsequently used TeamPCP-acquired credentials to breach CERT-EU (340 GB stolen from 42 EU departments) - which was attributed at the time to TeamPCP but per the operator was specifically ShinyHunters's operation: 'We didn't exfil from cert-eu at all, we don't even target gov.'

source
Operator self-narrationBreached forum sale post · 2026-05-20

“Not a ransom. 1 buyer and we shred the data on our end.”

A screenshot of the post (rendered via HackRisk.io threat-intel aggregator) shows the [Co-Owner]TeamPCP account advertising "Github's source code and internal orgs for sale" on the Breached forum. The author claims ~4,000 repos of private code, asks no less than $50K, and frames the operation as a clean transactional sale:

“As always this is not a ransom, we do not care about extorting Github, 1 buyer and we shred the data on our end, it looks like our retirement is soon so if no buyer is found we will leak it free.”
Read this skeptically

The self-framing (“not extorting”, “we shred the data”, “retirement is soon”) is operator PR, not a verifiable commitment. The same group is the supplier in this monetization graph: a documented partnership with the Vect ransomware crew (announced 2026-03-30), a partnership with the LAPSUS$ extortion group (per Mandiant + OSM), and a cross-actor credential pipeline into ShinyHunters' Cisco operation (300+ private repos). They also shipped the CanisterWorm wiper variant targeting Iran-locale Kubernetes nodes. The “clean single-buyer sale” framing is the reputational layer of an actor whose actual TTPs are partnership-with-extortionists + destructive payloads when locale matches.

Primary sources for the quote: The Hacker News and Bleeping Computer reporting on the Breached listing, plus the HackRisk.io render of the forum post itself.

How to defend

What to do about it

Every action below is free, open-source, or a platform built-in, and implementable by one engineer in less than a day. Where a control would have prevented or caught a specific TeamPCP incident, we say so. Tooling recommendations are vendor-neutral; where an authoritative standard or official platform guide exists, we link to it alongside the OSS implementation.

01Start here

01

Pin every GitHub Action to a full commit SHA

Replace mutable tags (uses: org/action@v1) with the full 40-char commit SHA. ratchet is a vendor-neutral OSS CLI that rewrites the YAML for you, locally - no SaaS dependency. GitHub's own security-hardening guide is the canonical reference for the practice. Mutable tags are the root vulnerability TeamPCP exploited against Trivy and KICS - this is the single highest-impact change you can make. Plus per Snyk's analysis: LiteLLM was compromised because its CI/CD pipeline fetched unpinned Trivy from apt - every defender on free-form `latest` is on borrowed time.

Resources
Would have prevented: trivy-main-strike, kics-github-action +3
02

Move maintainer accounts to passkeys (FIDO2/WebAuthn)

Replace SMS/TOTP 2FA with passkeys on every maintainer account on GitHub, npm, and PyPI. Per Okta's threat-intel analysis: TeamPCP's July 2025 PyPI phishing and Sept 2025 npm 2FA-reset phishing both relied on the human-defeatable steps of phishable second factors. Passkeys are bound to a domain and can't be phished. Required for every account that can publish.

Resources
Would have prevented: pypi-phishing-july-2025, npm-maintainer-phishing-sept-2025
03

Default to npm install --ignore-scripts (or pnpm v10 / Bun-as-installer)

Per Snyk SAP CAP analysis: the entire Mini Shai-Hulud worm fires via npm `preinstall` hooks before any code review. Setting `--ignore-scripts` (with an explicit allowlist for packages that legitimately need them) neutralizes that vector globally. pnpm v10 ships secure-by-default lifecycle policies; switching package manager is an option for teams that want this enforced for them. Two additional pnpm settings to enable in the same config: `trustPolicy: no-downgrade` (aborts installs when a package's trust signal regresses vs. a prior version) and `blockExoticSubdeps` (refuses `git+ssh` / `git+https` URLs in transitive dependencies).

Resources
Would have prevented: sap-cap-mini-shai-hulud, tanstack-mini-shai-hulud +2
04

Adopt minimum-release-age windows (refuse versions < 24h old)

Configure your package manager to refuse versions published less than N hours ago (pnpm has a 24h setting available; for npm/PyPI you implement this via policy + lockfile review). The @antv mass-republish on May 19 lived on npm for ~22 minutes of automated burst; the Nx Console malicious version was live for 18 minutes. A 24-hour cooldown would have caught both before they reached production builds.

Resources
Would have prevented: antv-wave, sap-cap-mini-shai-hulud +3
05

Audit every workflow using pull_request_target

Run `grep -r pull_request_target .github/workflows/` in every repo. Remove the trigger if it's not strictly needed; never check out PR code in a pull_request_target workflow. This trigger is the initial-access vector for the Feb 27 Trivy PwnRequest, the May 11 TanStack attack, and (per SANS) the earlier SpotBugs and Nx breaches.

Resources
Would have prevented: trivy-pwn-request, tanstack-mini-shai-hulud
06

Switch package publishing to OIDC / Trusted Publishers (scoped narrowly)

On PyPI, configure Trusted Publishers so packages are publishable only from a specific GitHub Actions workflow on a specific repo. npm has a similar provenance/OIDC model. CRITICAL caveat per Snyk SAP CAP: the @cap-js packages were published via OIDC trusted publishing where the trust config accepted the entire `cap-js/cds-dbs` repo. Scope your OIDC trust to a specific workflow on a protected branch, NOT to a whole repo. Otherwise the worm just runs your trusted workflow.

Resources
Would have prevented: litellm-pypi, telnyx-pypi +3
07

Require multi-approval PRs and digital commit signing

Require N approvals on every PR merge, and digitally sign every PR + commit. The TanStack PR #7378 (Mini Shai-Hulud initial vector) was a single-approver merge - multi-approval slows the attack and creates a paper trail. gitsign (Sigstore) gives free keyless signing tied to identity. Pair with lockfile-lint in CI to catch attackers who tamper with `package-lock.json` or `pnpm-lock.yaml` on accepted PRs (e.g., redirecting an integrity URL to a malicious host).

Resources
Would have prevented: trivy-pwn-request, tanstack-mini-shai-hulud
08

Run OpenSSF Scorecard against your dependencies

Hosted at deps.dev (Google) and scorecard.dev. Surfaces packages whose maintainers don't have 2FA enabled, whose actions aren't pinned, whose repos don't have branch protection. The cheap defender check is: if a package you depend on scores under 6/10, ask why before the next deploy.

Resources
09

Subscribe to CISA KEV + OSV.dev + GitHub Security Advisories

CVE-2026-33634 (Trivy) was added to CISA's KEV catalog with an April 8 federal remediation deadline. If you're not already subscribed to the KEV RSS feed, that's a 60-second fix and gives you the canonical 'rotate now' signal for everyone downstream. OSV.dev aggregates the open-source vulnerability picture across ecosystems; GitHub's advisory database is the same data with a browsable UI.

Resources
Would have prevented: trivy-main-strike, tanstack-mini-shai-hulud
10

Validate lockfile integrity in CI

Run lockfile-lint on every PR + CI run to assert lockfile entries resolve from trusted hosts (registry.npmjs.org), pin to SHA-512 integrity hashes, and use https. Lockfile injection - first disclosed by Liran Tal in 2019 - is where an attacker modifies `package-lock.json` or `pnpm-lock.yaml` to swap a dependency's resolved URL or integrity hash for a malicious one. It is silent at code review and devastating at install time. Free, OSS, drop-in to any GitHub Actions workflow.

Resources

02Per-incident lesson

For each major TeamPCP incident, the one control that would have prevented or caught it - paired with the free tool that implements it.

IncidentThe controlFree tool / framework
PyPI phishing (July 2025)Passkeys (FIDO2/WebAuthn) on every maintainer account; cooldown on metadata-driven outreach; harden support flows against 2FA-reset phishing pretexts
npm maintainer 2FA-reset phishing (Sept 2025)Passkeys make phishing-pretext 2FA-resets meaningless; passkeys cannot be transferred via support reset
Trivy PwnRequest (Feb 27)Audit and remove pull_request_target triggers from workflows; never check out PR code in a pull_request_target workflow. Pair with atomic token rotation so the next compromise after first detection can't reuse the old PAT.
Aqua incomplete rotation (Mar 1)Atomic token rotation: revoke old before issuing new; verify with API list of active tokens
Trivy main strike (Mar 19)Pin GitHub Actions to commit SHA; verify action contents via in-toto attestation
CanisterWorm (Mar 20)Egress block to ICP canister C2 (raw.icp0.io); enforce npm package signature verification
Checkmarx OpenVSX extensions (Mar 23)Pin VS Code/OpenVSX extension versions in .vscode/extensions.json; disable auto-update
KICS GitHub Action (Mar 23)Pin to commit SHA (same control as Trivy); deny push permissions to bot accounts post-publish
LiteLLM PyPI (Mar 24)PyPI Trusted Publishers; `pip --require-hashes`; remove .pth files at install time
Telnyx WAV steganography (Mar 27)Static analysis of non-code files in package payload; behavior-based detection on install scripts
Checkmarx Jenkins AST (Apr 1)Verify package provenance and signature attestations before installation. Catch version-impersonation by detecting unexpected publishers or missing attestations.
Bitwarden CLI (Apr 23)Pin every GitHub Action to a full commit SHA (the compromise reused a CI/CD GitHub Action vector); enable npm --ignore-scripts to neutralize the preinstall payload.
SAP CAP Mini Shai-Hulud (Apr 29)Disable npm preinstall scripts (--ignore-scripts) and scope PyPI Trusted Publishers + npm OIDC trust narrowly to specific workflows on protected branches, never whole repos. The @cap-js packages were published via OIDC trust scoped to the entire cap-js/cds-dbs repo, so the worm just ran the legitimate trusted workflow.
TanStack OIDC theft (May 11)Restrict pull_request_target cache write scope; alert on /proc/<pid>/mem reads by non-systemd processes
Shai-Hulud source code open-sourced (May 12)Detection-rule sharing; expect copycats with leaked code; treat every Mini-Shai-Hulud-family compromise May 12+ as actor-ambiguous when investigating
Nx Console v18.95.0 (May 18)Two-admin manual approval on every publish (single-maintainer publish was the proximate cause); rotate any session credentials that touched a CI runner via a compromised dependency; minimum-release-age applied to extensions as well as packages.
AntV mass-republish (May 18-19)Adopt a minimum-release-age window (24h is a good default). The @antv mass-publish bursts were ~6 seconds each; any cooldown longer than that catches them before they reach production builds.
DurableTask + AWS SSM (May 18)AWS SSM permission audit; restrict SendCommand to specific role principals; isolate password manager from CI environment
GitHub VS Code ext breach (May 19-20)Pin developer-installed extension versions in .vscode/extensions.json with auto-update disabled; allowlist Marketplace publishers via VS Code's settings policy; EDR on developer workstations; treat the IDE as a privileged execution surface.

03The free defender toolkit

Every tool below is pure OSS, a platform built-in, or an authoritative standards/documentation reference. Vendor-neutral throughout, runs locally where applicable. If it costs money to use the listed feature, it isn't here.

Action / dependency pinning

  • ratchet (sethvargo) ↗

    OSS CLI that pins, updates, and verifies GitHub Action references against a full commit SHA. Vendor-neutral, runs locally.

  • GitHub security-hardening guide ↗

    GitHub's own canonical reference for hardening Actions usage. Explicitly recommends pinning to a full commit SHA, and covers OIDC, least-privilege scopes, and third-party action review. Authoritative source if you want to do the rewrite manually.

  • pnpm minimum-release-age ↗

    Built-in pnpm setting that refuses to install package versions less than N hours old. 24h is a good default - catches mass-republish waves like @antv (May 19, 22-minute burst) before they reach production.

SBOM generation

  • SPDX ↗

    ISO-standard SBOM format (ISO/IEC 5962). Vendor-neutral starting point.

  • CycloneDX ↗

    OWASP SBOM format + tooling ecosystem. Vendor-neutral.

  • Syft (Anchore) ↗

    OSS CLI that generates SBOMs in either format from container images and filesystems.

Secret scanning

  • gitleaks ↗

    Fast OSS Git-history secret scanner. MIT-licensed, runs locally.

  • TruffleHog ↗

    OSS secret scanner with verified-finding mode. Used by the original Shai-Hulud worm; defenders should use it too.

  • GitHub Secret Scanning ↗

    Built into GitHub - free on public repos; enable the partner-token-revocation feature so leaked tokens get auto-rotated by the issuer.

Dependency auditing

  • OSV-Scanner ↗

    Google's OSS scanner that pulls advisories from OSV.dev across npm, PyPI, Go, Maven, container images, and more. Pure OSS, runs locally.

  • pip-audit ↗

    OSS Python-dependency auditor against the OSV database. Maintained by PyPA + Trail of Bits.

  • npm audit ↗

    Built into npm. Cheap and effective baseline.

  • OWASP Dependency-Track ↗

    Self-hosted SBOM analytics platform. OSS, OWASP project.

  • OpenSSF Scorecard ↗

    Automated assessment of repo security posture. OSS, OpenSSF project.

Runtime detection

  • Falco (CNCF) ↗

    Container/host runtime security with default rules for IMDS access, /proc/mem reads, suspicious curl.

  • Tetragon ↗

    eBPF-based observability and runtime enforcement from Isovalent (now Cisco).

  • Tracee ↗

    eBPF runtime security from Aqua (yes, the Trivy maintainers - they kept shipping).

Comprehensive playbooks / reference checklists

  • lirantal/npm-security-best-practices ↗

    Liran Tal's actively maintained npm-defender checklist: 17 numbered practices spanning post-install scripts, install cooldowns, lockfile validation, OIDC / provenance, dependency confusion, npx hardening, dev containers, and registry trust. Each recommendation links to a documented incident or CVE. Apache 2.0, OSS.

“Compromising a scanner can expose every secret accessible within that pipeline context.” - Cloud Security Alliance, on why CI/CD tool compromises carry exceptional risk. Pin your actions.

IOC ledger + actor profile

Indicators of compromise

147+ indicators across 13 domains, 23 SHA-256 hashes, 4 malware families, 10MITRE ATT&CK techniques, and 9 other categories - filterable, searchable, and exportable to CSV. Plus a separate 28-entry actor profile of names and accounts, role-tagged (actor-owned / sock-puppet / hijacked / impersonation).

Open full IOC dataset →
Credits

Standing on the shoulders of

This microsite consolidates 15+ vendor and independent reports into a single auditable view of the TeamPCP / UNC6780 campaign: 33 sourced incidents, a 38-edge chain-of-compromise DAG with per-edge confidence ratings, 147+ attributed indicators, and an incident-mapped defender playbook. Where the source reports disagreed on dates, counts, or attributions, we reconciled the contradictions in the open. Specific contributions are credited inline next to the claims they source elsewhere on the site; the catalog of contributors below is the full list.

This list is curated. The Sources block below carries every URL cited across the site, grouped by host (50+ entries).

Receipts

Sources

Every claim in this microsite traces to one of the references below.

beelzebub.ai
buymeacoffee.com
coinfomania.com
cybersecuritynews.com
github.com
isc.sans.edu
opensourcemalware.com
ramimac.me
ransomware-interviews.base44.app
snyk.io
socket.dev
thehackernews.com
unit42.paloaltonetworks.com
aikido.dev
akamai.com
bleepingcomputer.com
helpnetsecurity.com
okta.com
ox.security
sans.org
stepsecurity.io
threatlocker.com
wiz.io
x.com