Two men — aged 21 and 23 — were arrested in Cottesloe and Mandurah, Western Australia, on 26 August 2026, over the supply-chain campaign attributed to TeamPCP.

They face 14 charges between them, carrying between 3 and 20 years each. The younger man faces further charges over allegedly handling more than $100,000 in criminal proceeds and failing to comply with electronic data access orders.

They have been charged. Nothing below has been proven, and every allegation here is the AFP's.

What they are accused of

Compromising open-source packages and developer platforms to steal credentials, authentication secrets and source code.

Named packages: Trivy, LiteLLM, Telnyx, SAP and TanStack.

Named breached organisations: the European Commission, Mistral AI, OpenAI and GitHub.

The AFP's own figure: malicious code distributed by TeamPCP has potentially compromised over a thousand organisations worldwide, enabling the theft of half a million credentials and the exfiltration of at least 300GB of data. Global remediation costs are estimated in the hundreds of millions of dollars.

Trivy is the detail to stop on

Among the packages named is Trivy — a vulnerability scanner. It is the tool teams run to find out whether their containers and dependencies are safe.

Compromising it means poisoning the instrument, not the patient. A scanner runs with access to everything it inspects, it is trusted by definition, and its output is the thing people rely on to decide they are fine.

LiteLLM is the same shape from a different angle: a gateway that sits in front of model providers, which means it sees API keys.

Whoever chose these targets understood that the highest-value position in a software estate is not the application. It is the tooling everything else passes through.

The arithmetic that should worry a CISO

Two people. A thousand organisations. Half a million credentials.

That ratio is the whole argument for why supply-chain risk is different in kind from other risk. No amount of perimeter spending at any one of those thousand organisations would have changed the outcome, because the malicious code arrived through the front door, signed, versioned, and requested by their own build systems.

It is the same economics as a command-and-control framework selling for $99.99 and 119 people charged for jackpotting ATMs one machine at a time: build once, distribute through a channel that already has reach. Except here the channel is the one developers cannot opt out of.

The investigation

The AFP, the FBI and Western Australia Police worked the case, which began in April 2026 after information from cybersecurity firms.

Private industry finding it, three agencies across two countries running it, arrests four months later. That is a reasonable turnaround for a case of this shape, and it is worth saying so — the failures get written up more often than the functional outcomes.

What to do about it regardless of this case

  • Pin dependencies to hashes, not version ranges. A compromised release cannot silently arrive if you pin the artefact.
  • Treat build systems as production. They hold credentials and run untrusted code by design.
  • Scope CI tokens down. The reason a package compromise turns into an organisational one is usually a token that could do more than it needed to.
  • Assume your scanner can be the payload. Security tooling is not exempt, and this case is the demonstration.
  • Rotate anything a compromised package could have seen, and check whether it was ever used from an address you do not recognise.

What is not established

  • Guilt. They have been charged.
  • How the packages were compromised — maintainer account takeover, token theft or otherwise.
  • The cryptocurrency amounts the accused are alleged to have received. Not disclosed.
  • Whether TeamPCP is only these two people.
  • What was taken from the named organisations, as opposed to what access was obtained.