Australian cops cuff alleged TeamPCP masterminds
- ID
- 18939
- Status
- summarized
- Published
- 28 Aug 2026, 11:33 AM
- Fetched
- 28 Aug 2026, 3:23 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/28/australian-cops-cuff-alleged-teampcp-masterminds/5293157
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 7.0
- Created
- 28 Aug 2026, 3:24 PM
- Tags
- Audience
- developersdatabase_learnerssaas_founders
What happened
Australian Federal Police, assisted by the FBI, arrested two men in Perth (aged 21 and 23) allegedly behind TeamPCP, a cybercrime crew that inserted malicious code into open-source repositories. Their Shai-Hulud worm specifically targeted npm packages, harvesting credentials to public clouds and GitHub, and could wipe environments after replication. The AFP estimates over 1,000 organizations were compromised, 500,000+ credentials stolen, and 300GB+ of data exfiltrated, with global remediation costs in the hundreds of millions.
Why it matters
If you ship anything depending on npm packages, this is a concrete reminder to audit your dependency tree for compromised packages and rotate any cloud or GitHub credentials that may have been exposed through supply chain ingestion. The Shai-Hulud worm specifically hunted for cloud credentials inside infected npm environments, so CI/CD pipelines and build environments that pull public packages are the attack surface to check.
Discussion angle
What's your current process for vetting npm dependencies before they enter your build pipeline, and would you have caught a worm like Shai-Hulud that self-replicates through package infection?