Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks
Two Western Australian men (Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21) charged with 14 offences by the AFP for alleged involvement in TeamPCP's supply chain attacks TeamPCP compromised open-source security scanners Trivy and Checkmarx KICS, plus AI gateway LiteLLM, in March 2026 by stealing publishing credentials and pushing poisoned versions through official release channels The campaign spanned five distribution ecosystems (GitHub Actions, Docker Hub, npm, PyPI, OpenVSX) and potenti
Analysis
TL;DR
- Two Western Australian men (Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21) charged with 14 offences by the AFP for alleged involvement in TeamPCP's supply chain attacks
- TeamPCP compromised open-source security scanners Trivy and Checkmarx KICS, plus AI gateway LiteLLM, in March 2026 by stealing publishing credentials and pushing poisoned versions through official release channels
- The campaign spanned five distribution ecosystems (GitHub Actions, Docker Hub, npm, PyPI, OpenVSX) and potentially affected over 1,000 organizations globally, with reconstructed exposure estimates reaching 2,500+ organizations and 434,000 CI/CD pipelines
- The attackers open-sourced their worm framework (Mini Shai-Hulud) on GitHub in May 2026 and continued operations, including a fresh npm wave in August 2026 poisoning keyv and cacheable packages
- FBI advises organizations to rotate all CI/CD secrets, pin GitHub Actions workflows to verified commit SHA hashes, and search for repositories named tpcp-docs and docs-tpcp
Why It Matters
This case represents one of the most significant open-source supply chain attacks in recent history, directly impacting the AI development ecosystem through the compromise of LiteLLM—a critical gateway used by organizations to route requests across LLM providers and consolidate API keys. The attack demonstrates how a single weak dependency (unpinned Trivy in LiteLLM's build pipeline) can cascade into a multi-project compromise chain affecting thousands of organizations worldwide.
Technical Details
- Attack methodology: TeamPCP stole publishing credentials from compromised open-source projects and used them to push poisoned versions through official release channels. The compromise of one project (Trivy) provided credentials used to attack the next (Checkmarx KICS), which in turn enabled the LiteLLM compromise—a classic credential chain reaction.
- LiteLLM vulnerability: LiteLLM's build pipeline installed Trivy without pinning it to a verified version, allowing the poisoned scanner to exfiltrate the project's publishing token, which was then used to push backdoored LiteLLM releases in late March 2026.
- Distribution ecosystems targeted: GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX—spanning five major package and container registries.
- Worm framework: TeamPCP open-sourced the Mini Shai-Hulud worm framework on GitHub (May 12, 2026), which creates repositories named tpcp-docs and docs-tpcp using stolen credentials. The same toolkit was used in a fresh npm wave on August 4, 2026, poisoning the keyv and cacheable packages.
- Exposure scale: AFP estimates 1,000+ organizations compromised, 500,000+ credentials stolen, and 300GB+ data exfiltrated. CloudSEK reconstructed exposure at 2,500+ organizations and ~434,000 CI/CD pipelines. Hudson Rock attributed 118,829 CI runner dumps to 2,488 corporate domains from a 153GB archive. GitLab was the most affected platform (1,064 organizations), followed by GitHub Actions (618) and Azure DevOps (233).
- Persistence risk: Two malicious LiteLLM builds were removed from PyPI's index but still return HTTP 200 from PyPI's CDN at direct package URLs five months after removal, posing ongoing download risks.
Industry Insight
- Dependency pinning is non-negotiable: The LiteLLM compromise originated from an unpinned dependency in a build pipeline. Organizations must enforce strict dependency verification (SHA pinning, SBOMs, provenance checks) across all CI/CD pipelines, especially for security tooling that runs with elevated privileges.
- Supply chain attacks now target the toolchain, not just the code: TeamPCP's approach of compromising security scanners (Trivy, KICS) that organizations already trust and run in their pipelines represents a meta-attack on the software supply chain itself. Defenders need to treat their entire tooling ecosystem as a potential attack surface.
- Open-sourced attack tooling accelerates threat proliferation: TeamPCP's decision to open-source their worm framework on GitHub lowers the barrier to entry for other actors and creates a persistent, evolving threat. The security community should monitor fork activity and related repositories, while organizations should proactively search for indicators like tpcp-docs and docs-tpcp in their environments.
Disclaimer: The above content is generated by AI and is for reference only.