TeamPCP, a hacker group, has launched a widespread software supply chain attack affecting hundreds of organizations across GitHub and other platforms. The campaign represents an unprecedented effort to inject malicious code into open source repositories.
TeamPCP has executed a coordinated attack on open source software infrastructure, compromising multiple repositories and affecting a broad range of organizations that depend on these shared code libraries.
The group's strategy focuses on poisoning widely-used open source packages. By injecting malicious code into legitimate repositories, attackers gain access to any system that downloads or integrates the compromised software. This supply chain approach amplifies damage across hundreds of downstream users simultaneously.
GitHub has become a primary target due to the platform's role as a central hub for open source development. The attack underscores vulnerabilities in how modern software relies on shared code repositories with minimal verification mechanisms.
Supply chain attacks have grown increasingly common, but TeamPCP's scale distinguishes this campaign. Previous incidents typically targeted specific high-value packages or organizations. This operation demonstrates the ability to compromise multiple projects systematically, suggesting sophisticated planning and resources.
Organizations using affected packages face potential data theft, system compromise, or operational disruption. The distributed nature of open source means compromised code can spread rapidly before detection, affecting enterprises, government agencies, and critical infrastructure.
Security researchers recommend organizations audit their dependencies, verify package integrity, and implement strict code review processes. Tools for dependency scanning and software composition analysis have become essential infrastructure.
The incident highlights structural challenges in open source security. Most projects operate with limited resources and volunteer maintainers unable to implement enterprise-grade security practices. As attackers grow more sophisticated, the gap between threats and available defenses continues widening.
This attack will likely accelerate discussion around supply chain security standards, package verification mechanisms, and resources for open source project maintenance. The industry faces a critical choice between maintaining open source's accessibility or implementing restrictions that could limit innovation.
U.S. federal prosecutors have unsealed charges against three Russian nationals accused of operating a bulletproof hosting service that supported ransomware gangs responsible for over $62 million in damages worldwide.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that attackers are actively exploiting three vulnerabilities in Internet-exposed on-premises SharePoint Server instances. Organizations running affected versions must patch immediately.
Tailscale disclosed a critical vulnerability in its SSH implementation that allowed attackers to gain root access through insecure argument handling. The flaw has been patched in recent versions.
A new study found that social media platforms referred over 5.7 million visits to nonconsensual deepfake pornography sites between December 2025 and March 2026, with YouTube and X accounting for the majority of traffic.