teampcp-supply-chain-attack

TeamPCP 공급망 공격: 기술 분석 및 탐지 가이드 CVE-2026-33634 CVSS 9.4 — 2026년 현재까지 가장 영향력이 큰 CI/CD 공급망 공격. 2026년 3월 19일부터 25일 사이, 위협 행위자 TeamPCPDeadCatx3, PCPcat, ShellForce, CanisterWorm으로도 추적됨는 GitHub Actions, Docker Hub, OpenVSX, npm, PyPI 등 5개 생태계에 걸친 연쇄적 공급망 손상을 실행했습니다. 불완전하게 순환된 단일 GitHub PAT에서 시작된 이 캠페인은...

tanscript-exploit-check

미니 샤이-훌루드 공급망 공격 — IOC 점검기 curl -fsSL https://raw.githubusercontent.com/nkopylov/tanscript-exploit-check/main/check-tanstack-exploit.sh | bash 또는 클론하여 로컬에서 실행: git clone https://github.com/nkopylov/tanscript-exploit-check.git cd tanscript-exploit-check ./check-tanstack-exploit.sh 프로젝트디렉토리 ... 발생한...

CVE-2026-33634-Scanner

CVE-2026-33634-Scanner 扫描器，用于自动检测与 TeamPCP 供应链攻击（CVE-2026-33634）相关的入侵指标（IOC） 📋 目录 概述 漏洞 功能特性 检测到的 IOC 安装 使用方法 示例 报告格式 项目结构 系统要求 贡献 许可证 作者 参考资料 🎯 概述 CVE-2026-33634-Scanner 是一款安全工具，旨在检测与 TeamPCP 供应链攻击相关的入侵指标（IOC），该攻击是一个影响通过受感染渠道分发的多个软件组件的严重漏洞。 该工具执行全面扫描，查找以下内容： 通过 SHA256 哈希识别的恶意文件 与命令与控制（C2）基础设施的网络...

An Undercover Google Analyst Infiltrated a Notorious Supply-Chain Hacking Gang

TeamPCP pulled off the worst-ever software supply-chain hacking spree and breached thousands of companies. Now Google’s threat intelligence group says it had a mole inside the hackers’ inner circle...

Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours

Threat actors are continuing to leverage artificial intelligence AI to streamline their operations, with one financially motivated hacking group employing an autonomous, multi-agent attack framework to carry out a large-scale credential harvesting campaign within six hours. Google Threat...

Two Alleged ‘TeamPCP’ Hackers Arrested in Australia

Authorities in Australia have arrested two men believed to be members of TeamPCP , a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police AFP said two men...

Containers on fire: from container escapes to supply chain attacks

Introduction Modern infrastructures universally rely on containerization to deploy applications, scale services, and build cloud platforms. The use of Docker, Kubernetes, and similar technologies has become the corporate standard for efficient automation. However, as containers grow in popularity...

A Hacker Group Is Poisoning Open Source Code at an Unprecedented Scale

GitHub is just the latest victim of TeamPCP, a gang that has carried out a spree of software supply chain attacks that has impacted hundreds of organizations...

GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension

GitHub on Wednesday officially confirmed that the breach of its internal repositories was the result of a compromise of an employee device involving a poisoned version of the Nx Console Microsoft Visual Studio Code VS Code extension. The development comes as the Nx team revealed that the extensio...

GitHub Breach: TeamPCP Steals 3,800 Repositories via VS Code Extension

GitHub Breach: TeamPCP stole 3,800 internal repositories through a malicious VS Code extension and is now selling the data online for $95,000...

GitHub Breached — Employee Device Hack Led to Exfiltration of 3,800+ Internal Repos

GitHub on Tuesday said it's investigating unauthorized access to its internal repositories after the notorious threat actor known as TeamPCP listed the platform's source code and internal organizations for sale on a cybercrime forum. "While we currently have no evidence of impact to customer...

durabletask: TeamPCP's Latest PyPi Compromise

Discover the latest on malicious versions of the pypi package durabletask, matching TeamPCP tactics...

The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave

Multi-ecosystem supply chain compromise by TeamPCP targets GitHub, NPM, and VSCode to steal credentials and establish persistence...

Malicious code in @starmind/collector-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33a028c205d18a30d3ff150b1653336fefa0ac86a6e5242811b6fb2c3283af21 The package @starmind/collector-cli was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3847 Malicious code in openclaw-cn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98bf501cd2484b70d4811afe69007c54a9a94bcd9c137c0782a0c610a475b434 The package openclaw-cn was found to contain malicious code. Source: ghsa-malware 8f29660ec3d5b6462ff4857bf0696a14fbcf401d5f3a074376b0c9840b380612 An...

Malicious code in @antv/g-plugin-zdog-svg-renderer (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/gi-assets-tugraph (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-4120 Malicious code in @antv/xflow-diff (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/adjust (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-4022 Malicious code in @antv/graphin (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...