TeamPCP Open-Source Software Supply Chain Attack Group

Technical Analysis

TeamPCP is alleged to have created and distributed malicious open-source software packages over an extended campaign, exploiting the trust developers and automated build systems place in public package registries (e.g., npm, PyPI, or similar ecosystems, though specific registries were not detailed in this report). This class of attack typically relies on typosquatting, dependency confusion, or account takeover of legitimate maintainers to inject credential-stealing, backdoor, or data-exfiltration code into widely-used packages. Once installed, malicious payloads can harvest environment variables, API keys, cloud credentials, and CI/CD secrets from build and runtime environments. Organizations running AI agent frameworks, LLM tool-use pipelines, or RAG systems frequently pull dependencies from these same open-source ecosystems for orchestration, vector stores, and tool integrations, meaning a compromised package installed by an agent's build process or autonomous package-management routine could silently exfiltrate LLM API keys, database credentials, or internal tool secrets, enabling downstream compromise of the agent's connected systems.

Affected Systems

Organizations and CI/CD pipelines that installed malicious open-source packages distributed by TeamPCP; specific package names, versions, and registries were not disclosed in the source report

Indicators of Compromise

• No specific hashes, IPs, or domains disclosed in source reporting; refer to AFP statement and forthcoming KrebsOnSecurity technical follow-up for named malicious packages

Remediation Steps

1. 1

   Audit dependency provenance

   Review all open-source packages installed in build systems, CI/CD pipelines, and agent/tooling environments for unexpected maintainers, recent ownership transfers, or suspicious post-install scripts.

2. 2

   Rotate exposed credentials

   Rotate API keys, cloud credentials, and secrets that may have been accessible to compromised build or runtime environments, including those used by AI agents and LLM tool integrations.

3. 3

   Implement package pinning and lockfiles

   Use strict version pinning, lockfiles, and checksum verification to prevent silent installation of malicious package updates.

4. 4

   Deploy software composition analysis (SCA)

   Integrate SCA tooling into CI/CD and agent deployment pipelines to detect known-malicious or anomalous open-source packages before deployment.

5. 5

   Monitor for exfiltration indicators

   Review logs for unusual outbound network connections from build servers and agent runtime environments that may indicate credential exfiltration.