TeamPCP, a threat actor group, has claimed responsibility for breaching GitHub repositories and is linked to at least 20 waves of supply chain attacks affecting over 500 software projects globally.
TeamPCP has emerged as a significant threat to the software development ecosystem, executing a coordinated campaign of supply chain attacks that extends well beyond the recent GitHub breach.
According to security researchers at Socket, the group conducted roughly 20 separate attack waves targeting software repositories and package managers. These attacks successfully compromised more than 500 individual pieces of software, affecting hundreds of organizations across multiple industries.
Supply chain attacks represent a particularly dangerous threat vector because they compromise software at its source, allowing attackers to inject malicious code into legitimate packages and tools. When developers download and implement these compromised components, they unknowingly distribute the malware to their own systems and end users.
The GitHub breach claim marks TeamPCP's most high-profile target to date, but the group's broader campaign reveals a more systematic approach to infiltrating the software supply chain. By executing multiple waves of attacks, the group has demonstrated sustained resources and operational sophistication.
The discovery raises concerns about the security practices across package repositories and version control platforms. Developers often trust code from these sources without extensive verification, creating opportunities for malicious actors to spread compromised code widely before detection.
Organizations using affected software are advised to audit their dependencies immediately and review any recent updates to packages in their environments. Socket and other security firms are working to identify and flag compromised packages to prevent further distribution.
The scale of TeamPCP's operations underscores the vulnerability of open-source software ecosystems, which rely on community trust and often lack comprehensive security oversight. As supply chain attacks grow more prevalent, experts recommend implementing stricter code review processes, dependency scanning tools, and verification mechanisms across development pipelines.
U.S. federal prosecutors have unsealed charges against three Russian nationals accused of operating a bulletproof hosting service that supported ransomware gangs responsible for over $62 million in damages worldwide.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that attackers are actively exploiting three vulnerabilities in Internet-exposed on-premises SharePoint Server instances. Organizations running affected versions must patch immediately.
Tailscale disclosed a critical vulnerability in its SSH implementation that allowed attackers to gain root access through insecure argument handling. The flaw has been patched in recent versions.
A new study found that social media platforms referred over 5.7 million visits to nonconsensual deepfake pornography sites between December 2025 and March 2026, with YouTube and X accounting for the majority of traffic.