"The alleged compromise of a small number of trusted software components had a significant global impact," the Australian Federal Police said, framing a sweep that on August 26 produced two arrests tied to a year-long pattern of developer supply-chain intrusions.
AFP, FBI and Western Australia Police: arrests in Cottesloe and Mandurah
Australian authorities arrested two men, aged 21 and 23, in the western Australian cities of Cottesloe and Mandurah on August 26, 2026. The AFP, working with the FBI and Western Australia Police, seized electronic devices and other material for forensic analysis during the operation. Police allege the suspects received cryptocurrency payments for participation in TeamPCP operations. The two face a combined 14 charges that include possessing and supplying data for computer offenses and modifying data to facilitate serious crimes; penalties for each charge range from three to 20 years' imprisonment. The younger suspect also faces charges alleging he dealt with at least $100,000 in criminal proceeds and failed to comply with an order requiring access to electronic data. The AFP said it has not ruled out further arrests or charges as it examines seized evidence.
Targets and breaches linked to TeamPCP
Authorities and reporting attribute a broad set of supply-chain compromises to TeamPCP. High-profile software and platform impacts cited by investigators include Trivy, LiteLLM, Telnyx, SAP, and TanStack packages. The group's activity has also been linked to breaches of large organizations and platforms, including the European Commission, Mistral AI, OpenAI, and GitHub. According to law enforcement, TeamPCP targeted open-source software and developer platforms to harvest credentials, authentication secrets, and source code.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleMethod: malicious code injection into open-source repositories
Investigators say TeamPCP actors injected malicious code into software hosted on open-source repositories. Developers who later pulled or depended on those packages incorporated the malicious components into applications running in government, academic, and private-sector environments without realizing they had been compromised. Law enforcement describes the activity not as the work of a tightly organized cell but as the output of a loose-knit collective whose members frequent shared hacking forums, Discord servers, and Telegram channels.
Scale: organizations affected, credentials stolen, and data exfiltrated
The AFP, FBI, and Western Australia Police report that malicious code distributed by TeamPCP has potentially compromised over a thousand organizations worldwide. Investigators estimate the theft of approximately half a million credentials and the exfiltration of at least 300GB of data. The agencies further report that global remediation costs tied to the campaign are estimated to be in the hundreds of millions of dollars.
Investigation timeline, evidence and reporting by Flare and Brian Krebs
The investigation into TeamPCP activity began in April 2026 after the AFP and the FBI received key information from cybersecurity firms. Law enforcement says forensic analysis is now under way on the devices and materials seized during the August 26 actions. Independent reporting followed the arrests: researchers at Flare and journalist Brian Krebs published separate investigations that traced Telegram activity, reused aliases, online accounts, and other traces to link alleged TeamPCP members to real-world identities.
What this means for open-source maintainers, affected enterprises, and law enforcement
- Open-source maintainers will confront renewed scrutiny of repository supply-chain integrity and the risks that injected code can reach downstream users, given investigators' findings about malicious components in trusted packages.
- Affected enterprises — including government, academic, and private-sector organizations named in the investigation — will be focused on credential exposure, source-code leaks, and remediation costs after what investigators describe as more than 1,000 potentially compromised organizations.
- Law enforcement is proceeding with forensic analysis and prosecutions: the AFP has charged two suspects, says further arrests or charges remain possible, and reports that cryptocurrency played a role in payments to alleged participants.
The arrests mark a concrete move from attribution and reporting to criminal charges and forensic inquiry. With seized devices now in hand and prosecutors pursuing a slate of computer-offense charges — including allegations of dealing in criminal proceeds — the immediate next step is the forensic analysis that the AFP says will inform whether more arrests or charges follow.
