Two arrests do not end a supply chain campaign. They tell us which parts of the campaign finally became visible enough for investigators to put names, devices, warrants, and charges around them.

On August 27, 2026, the Australian Federal Police said two Western Australian men had been charged after an AFP, FBI, and Western Australia Police Force investigation into an alleged cybercrime syndicate that created malicious open-source software. The group named in U.S. statements is TeamPCP. The defensive lesson is not that one crew got caught. It is that developer ecosystems now let a small number of stolen credentials become a global incident.

TL;DR

  • AFP says the alleged campaign potentially compromised more than 1,000 organizations, stole more than 500,000 credentials, and exfiltrated at least 300GB of data.
  • ABC News identified the two Perth defendants as Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23; U.S. prosecutors separately indicted Thomson over alleged TeamPCP supply chain attacks.
  • The alleged attack pattern was simple in principle: compromise trusted software, steal downstream credentials, use those credentials to spread and extort.
  • Arrests reduce operator capacity, but they do not revoke stolen tokens, clean poisoned build systems, or fix automated dependency adoption.
  • Defenders should treat package publishing, CI/CD credentials, developer extensions, and dependency update bots as one connected attack surface.

What Authorities Say Happened

The AFP said parallel investigations began in April 2026 after cyber threat assessment companies provided information about a syndicate allegedly inserting malicious code into open-source repository software that other developers then used. Police allege the infected software reached systems across government, academia, and the private sector, enabling credential theft and data exfiltration.

The scale claimed by authorities is large: more than 1,000 organizations potentially compromised, more than 500,000 credentials and authentication materials stolen, at least 300GB of data exfiltrated, and global remediation costs estimated in the hundreds of millions of dollars. Those are law-enforcement allegations, not court-proven findings.

ABC News reported that the defendants are Ruben Ian Thomson and Louis Michael Gaebler. The U.S. Department of Justice separately said a federal grand jury indicted Thomson on August 25, 2026, alleging he conspired with others to exploit trusted software supply chain security tools and inject malicious code that cascaded into downstream customers. DOJ explicitly notes that an indictment is only an allegation and the defendant is presumed innocent unless proven guilty.

KrebsOnSecurity adds the attribution layer: TeamPCP had been linked to Shai-Hulud activity, developer credential theft, open-source package poisoning, and data extortion. Krebs’ reporting also matters because it traces the human operational security failures that can turn forum handles, infrastructure reuse, chat identities, and real-world records into investigative leads.

The Attack Pattern

TeamPCP’s alleged model was not magic. It was leverage.

  1. Compromise a maintainer, developer endpoint, CI workflow, package account, or trusted development tool.
  2. Add malicious code to software other developers already install or execute.
  3. Scan downstream environments for GitHub tokens, cloud keys, SSH keys, npm tokens, API secrets, and session material.
  4. Use those credentials to compromise more projects, publish more malicious updates, or access victim cloud environments.
  5. Extort organizations using stolen data and access.

That loop is why software supply chain incidents move faster than ordinary intrusion response. A compromised package version can be pulled by CI runners, developer laptops, and update bots before a human reviewer has even read the changelog.

This also explains why the arrest story should not be read as cleanup complete. If credentials were harvested months earlier, some may still be valid. If a build system was modified, the malicious path may outlive the original operator. If an organization only removed a bad package but did not rotate tokens, it may have closed the front door while leaving the stolen keys active.

Why GitHub’s Recent Changes Matter

GitHub’s July 2026 supply chain security update reads like a direct response to this class of attack. The platform highlighted controls aimed at three links in the chain: initial compromise, credential exfiltration, and propagation.

The most practical changes are worth treating as policy prompts:

ControlWhat it disrupts
npm trusted publishingRemoves long-lived package publishing tokens from CI/CD where malware wants to steal them.
npm staged publishingRequires additional approval before a staged package reaches the registry.
npm v12 install-script restrictionsReduces automatic execution during package installation.
Read-only Actions cache for untrusted triggersLimits cache poisoning paths from lower-trust workflows into privileged jobs.
Dependabot default cooldownDelays routine version-update PRs for three days while malicious releases are more likely to be detected and removed.

Dependabot’s cooldown is not a security scanner. It is a waiting period. That distinction matters. It helps against fast-burn malicious releases that are discovered quickly; it does less against a quiet backdoor that sits for weeks.

What Defenders Should Check Now

Start with developer identity and automation, not just endpoints.

For GitHub and GitLab admins:

  • Review new personal access tokens, SSH keys, OAuth grants, deploy keys, and GitHub App installations created since March 2026.
  • Check for unusual repository cloning, mass secret scanning alerts, new workflow files, modified release jobs, and unexpected package publishing events.
  • Disable or tightly scope long-lived publishing tokens; move supported packages to OIDC-based trusted publishing.

For CI/CD owners:

  • Audit workflows that run untrusted pull request code, especially pull_request_target patterns and release jobs that share cache or artifacts with lower-trust jobs.
  • Separate build, test, release, and publish credentials. A test job should not be one command away from publishing to npm, PyPI, Docker Hub, or an internal registry.
  • Log outbound network activity from runners. Credential-stealing malware usually needs an exit path.

For package maintainers:

  • Enable staged publishing where available.
  • Add dependency cooldowns for routine updates and keep security updates fast.
  • Pin dependencies with lockfiles, review install scripts, and block git or remote URL dependencies unless there is a documented need.

For incident responders:

  • Treat any suspected TeamPCP-related package execution as a credential incident first.
  • Rotate repository, cloud, package registry, CI/CD, SaaS, and SSH credentials reachable from the affected environment.
  • Search build logs and endpoint telemetry for unexpected package post-install execution, outbound traffic from install steps, and new persistence created by developer tools.

The Bigger Lesson

TeamPCP’s alleged success was not only technical skill. It was ecosystem timing. Modern engineering stacks reward speed: automatic updates, frictionless publishing, reusable CI actions, editor extensions, shared caches, and tokens that make automation painless.

Attackers found the same convenience layer.

Law enforcement can remove people from the keyboard. Defenders still have to remove the assumptions that let one compromised developer tool become many compromised organizations. The practical answer is slower where speed creates blind trust, stricter where tokens carry production authority, and more observable where automation used to be treated as boring plumbing.

Sources