The Worm in the Toolchain: How TeamPCP Built a Credential Extraction Economy Inside Open Source- 201

June 23, 2026

The most consequential credential theft does not happen when a user clicks a phishing link. It happens when a developer runs npm install. TeamPCP spent months embedding harvesting malware inside the packages that professional developers trust most implicitly — security scanners, AI model gateways, enterprise cloud frameworks — turning the software update channel itself into the attack surface. By the time the payload fires, the developer has already done everything right.

The result is not a series of discrete breaches but an ongoing extraction operation targeting the infrastructure layer of modern software delivery, accumulating cloud secrets, AI provider keys, and organizational tokens from compromised developer environments at a scale that individual incident disclosures significantly understate.

The architecture of the campaign is built around the Shai-Hulud worm, a modular TypeScript/Bun toolkit that TeamPCP or an affiliated developer engineered for three simultaneous functions: credential harvesting from developer workstations and CI/CD pipelines, self-propagating supply chain poisoning into additional packages, and encrypted data exfiltration. When Datadog researchers examined the source code after an individual claiming TeamPCP affiliation released it publicly in late April, they found a coherent and professionally structured framework rather than crude malware — a toolkit that automates the full operational cycle from infection through lateral spread to extraction, designed to run invisibly inside the build infrastructure of organizations whose security controls are oriented toward their production environments rather than their developer toolchains.

The choice of targets is the campaign's most analytically significant feature. TeamPCP has not poisoned random or low-value packages. Aqua Security's Trivy vulnerability scanner is infrastructure tooling used to scan container images and filesystems for security flaws — a tool that, by its nature, requires privileged access to the environments it scans and is trusted precisely because it is a security product. LiteLLM is a proxy and SDK middleware layer that enables organizations to call multiple AI models through a single unified API, storing OpenAI, Anthropic, and Amazon Bedrock API keys in its database. The four SAP CAP npm packages poisoned in late April collectively receive 572,000 weekly downloads and are central to enterprise cloud application development. Lightning, the PyPI deep learning framework, sees hundreds of thousands of daily downloads and is embedded in AI model training pipelines across the industry. Intercom's npm SDK is installed in backend services and CI/CD pipelines across more than a hundred dependent projects. In each case, the package sits at a point of maximum privilege and minimum scrutiny — the kind of dependency that organizations install once and then stop thinking about, because the package is trusted, signed, and maintained by a reputable vendor.

The downstream consequences of this targeting strategy are visible in the documented breaches. The Trivy compromise gave TeamPCP an API key with control over AWS accounts affiliated with the European Commission, from which they exfiltrated 340 gigabytes of uncompressed data covering 71 EC and EU-affiliated entities — subsequently posted on ShinyHunters' Tor-based leak site, illustrating the now-familiar pattern where credential theft and extortion infrastructure intersect. The LiteLLM SQLi vulnerability, separately from the supply chain compromise, was exploited within 36 hours of disclosure by an attacker who went directly to the database tables containing provider credentials, skipping benign tables entirely — the kind of targeted precision that suggests prior knowledge of the application's architecture, possibly from earlier supply chain access. Two devices belonging to OpenAI employees were compromised in the TanStack incident before the company detected and contained the breach, the Shai-Hulud worm having spread from TanStack to nearly 400 dependent packages.

The SAP Mini Shai-Hulud wave, documented in the final days of April, illustrates how the campaign's self-propagation logic works at scale. The malicious preinstall scripts embedded in the poisoned SAP packages execute automatically on every npm install — before any application code runs — collecting GitHub tokens, npm credentials, cloud provider secrets across AWS, Azure, and GCP, Kubernetes tokens, and GitHub Actions secrets, then exfiltrating them as encrypted payloads into GitHub repositories created under the victim's own account. The choice of the victim's own GitHub account as the exfiltration destination is a deliberate defense evasion technique: outbound traffic to a user's own GitHub repository is among the least likely categories of network activity to trigger security alerts.

The VECT 2.0 ransomware partnership, announced by the VECT operators on BreachForums, introduces a further dimension. VECT operators stated their intention to deploy ransomware payloads against organizations already compromised through TeamPCP's supply chain attacks, creating a two-stage exploitation model in which credential theft provides initial access and ransomware provides monetization. The technical flaw in VECT 2.0 — a nonce-handling error that causes the ransomware to overwrite nonces during chunk encryption, losing the decryption keys for all but the final 25% of any file above 128KB — means the ransomware functions as an accidental data wiper against virtually every file type enterprises care about: VM disks, database files, backups, documents, spreadsheets. VECT operators themselves cannot decrypt files encrypted by their own tool. Organizations that have paid TeamPCP's downstream ransomware affiliate for a decryption key they cannot provide have paid for nothing while losing their data permanently.

The release of the Shai-Hulud source code by an individual claiming TeamPCP affiliation is perhaps the most consequential development in the campaign's arc. Whether the release was an exit maneuver, an internal dispute made public, or a deliberate seeding of the methodology into the broader criminal ecosystem is unknown. What is known is that a professionally documented, modular, self-propagating supply chain attack framework is now publicly available, lowering the barrier to entry for any threat actor with the technical competence to deploy it. TeamPCP may or may not continue operating under that identity. The capability it built, distributed to the open-source developer community via its own victims' package registries, is now available to anyone who wants it.