"The AFP said the malicious code potentially compromised more than 1,000 organizations globally, enabled the theft of more than 500,000 credentials, and led to the exfiltration of at least 300 gigabytes of data."
AFP charges, arrests, and search warrants
The Australian Federal Police (AFP) on August 27, 2026 charged two Western Australian men with a combined total of 14 offences for their alleged roles in TeamPCP, the syndicate blamed for the March 2026 supply-chain campaign. Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21, appeared in Perth Magistrates Court the same day, following joint AFP and Western Australia Police Force searches at properties in Cottesloe, Hamilton Hill, and Mandurah. Electronic devices were seized for forensic analysis.
Police allege the two men were principal participants in the syndicate and received payments in cryptocurrency; the value of that cryptocurrency is still under investigation. The AFP and the charges as reported specify counts tied to possessing and supplying data with intent to commit computer offences, multiple counts of unauthorized modification of data with intent to commit a serious offence, and a count of dealing with proceeds of crime worth $100,000 or more. One count, brought under section 3LA of the Crimes Act 1914 (Cth), carries a maximum penalty of 10 years' imprisonment; the proceeds-of-crime count carries a maximum of 20 years. None of the 14 charges names a specific compromised project.
How TeamPCP's supply-chain worm operated
Investigators describe a chained, credential-theft technique that abused trusted release processes. The syndicate repeatedly stole publishing credentials from open-source projects and used those tokens to push poisoned versions through the projects' own release channels. The campaign spanned five distribution ecosystems: GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX.
According to the reporting, credentials harvested during one compromise were used against the next: credentials taken during the Trivy scanner compromise were turned on the Checkmarx KICS actions days later. LiteLLM’s build pipeline installed Trivy without pinning it to a verified version; the poisoned scanner then took the project's publishing token, which the actor used to push backdoored LiteLLM releases in late March. LiteLLM routes requests across large language model (LLM) providers and sits where an organization's provider keys are consolidated, placing it in a sensitive position for any supply‑chain compromise.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildScope of exposure: AFP, industry trackers, and confirmed victims
The AFP's summary of the campaign includes the headline figures above: potential compromise of more than 1,000 organizations, theft of more than 500,000 credentials, and at least 300 gigabytes exfiltrated. Unit 42 published the same two figures in March, phrasing them as what the actor "may have exfiltrated."
Subsequent August analyses offered larger reconstructed exposure counts. CloudSEK reported more than 2,500 organizations and roughly 434,000 CI/CD pipelines exposed; Hudson Rock attributed 118,829 CI runner dumps to 2,488 corporate domains from what it described as a 153GB archive of the attackers' exfiltrated data. CloudSEK emphasized that credential theft alone is not proof a company was successfully compromised, and the confirmed victim count remains the 16 organizations TeamPCP itself published on its leak site as of late March.
StepSecurity's analysis of CloudSEK's dataset found GitLab led affected platforms with 1,064 organizations, followed by GitHub Actions on 618, Azure DevOps on 233, Jenkins on 105, Bitbucket Pipelines on 94, and CircleCI on 15.
Related tool releases, continuing indicators, and FBI guidance
Oligo Security traced TeamPCP-linked infrastructure back to 2020 in an August 5 report, linking the group to activity previously tracked as TA-NATALSTATUS and IronErn through overlapping domains, malware deployment paths, staging techniques, and backend infrastructure — though Oligo said whether that continuity reflects a rebrand, a shared operator set, or close collaboration "cannot be determined with 100% certainty."
The group open-sourced the worm framework used in the Mini Shai-Hulud campaign to GitHub on May 12, 2026. A fresh npm wave using the same toolkit poisoned the keyv and cacheable packages on August 4, 2026; Socket reported that the self‑identifying markers that would tie the sample to a named campaign were not recovered.
The Hacker News confirmed via PyPI on August 27 that the two malicious LiteLLM builds no longer appear in the package's release history, yet both still return HTTP 200 from PyPI's content delivery network at their direct package URLs five months after removal from the index.
On July 2 the FBI issued an advisory urging organizations impacted by the campaign to treat exfiltrated data and credentials as a persistent risk and to rotate all continuous integration and continuous delivery (CI/CD) secrets, publishing tokens, and cloud credentials accessible during exposure windows. The advisory lists tpcp-docs and docs-tpcp as repository names the worm creates and advises defenders to search for them; it also recommends pinning all GitHub Actions workflows to verified commit SHA hashes rather than floating version tags.
What this means for open-source maintainers, CI/CD teams, and organizations using LLM gateways
- Open-source maintainers: Loss of publishing tokens was the core enabler of the campaign; maintainers will need to audit build pipelines, pin scanner and action versions to SHAs, and search for the tpcp-docs/docs-tpcp repositories the FBI named.
- Enterprise CI/CD security teams: The multiple-platform footprint — GitLab, GitHub Actions, Azure DevOps, Jenkins, Bitbucket, CircleCI — means defenders should consider rotating exposed secrets and treating large credential sets as a persistent risk, per the FBI advisory.
- Organizations using LLM gateways: Because LiteLLM aggregates provider keys, its compromise illustrates the concentration risk where a single build path can expose multiple downstream provider credentials and customer data.
The arrests in Perth add a criminal-investigative chapter to an incident that produced technical artifacts, public indicators, and contested exposure tallies. AFP seizure of devices and an ongoing cryptocurrency valuation inquiry underline that the legal and forensic story continues even as security teams wrestle with artifacts still surfacing across package registries and CI systems. The record is concrete on methods and on a long tail of exposed credentials; what remains to be resolved in public is how many of the identified credential thefts turned into confirmed intrusions and how the crypto trail will map to alleged proceeds.
