Over the course of roughly two weeks, the threat group known as TeamPCP carried out a systematic series of supply chain intrusions against widely-adopted open source developer tooling. The campaign has been tracked from its earliest confirmed incident through each subsequent escalation.

All four documented attack vectors deployed malware purpose-built to exfiltrate cloud provider credentials, SSH keys, Kubernetes configs, and CI/CD secrets. Stolen material was encrypted before exfiltration to attacker-controlled infrastructure, then rapidly validated and used to pivot through victim environments. Operational consistency across all intrusions points to a single coordinated actor — though credential sharing or resale to third parties cannot be ruled out.