Authorities arrest 2 alleged members of prolific hacking group TeamPCP
Executive Take
This shows how two people hiding behind open source packages can hit a thousand companies at once. Any company using open source code needs to check its software build pipeline for similar malware right now.
Executive Summary
Australian Federal Police arrested two men from Cottesloe and Mandurah, Western Australia, charging them with 14 offenses tied to TeamPCP, a hacking group active since December. TeamPCP allegedly ran supply-chain attacks that infected open source packages with self-spreading malware, compromising over 1,000 organizations worldwide via CI/CD pipelines.
Why It Matters
Technology and cybersecurity leaders should care because this attack spread through software build pipelines (CI/CD), a tool nearly every tech company relies on. One compromised package can silently infect hundreds of downstream organizations.
Bizquad Perspective
Most leaders will read this as a crime story, not a warning that their own CI/CD pipeline could already be carrying malware from a package they installed months ago.