Australian Federal Police arrest two Western Australia men on 14 charges tied to TeamPCP supply-chain compromises

The arrests followed a multi-month investigation into TeamPCP's sustained supply-chain campaign. The group targeted CI/CD pipelines to embed the Shai-Hulud worm in open-source packages, enabling self-propagation through subsequent updates. Australian authorities stated the defendants participated in the nine-month operation that compromised over 1,000 entities worldwide. KrebsOnSecurity identified the suspects and documented operational security lapses including reused infrastructure that enabled tracing.

TeamPCP's method differed from prior incidents such as the 2020 SolarWinds compromise by focusing on developer tooling rather than enterprise update servers. Infection counts exceed documented cases in the XZ Utils backdoor attempt of 2024. The worm's attachment to package updates created persistent downstream exposure without requiring direct victim interaction. Data from the AFP statement and Krebs reporting show repeated use of the same build-system footholds across multiple repositories.

Coverage omitted the forensic linkage between the arrested individuals and earlier TeamPCP infrastructure observed in December 2025 logs. Reused payment accounts and VPN exit nodes provided the decisive attribution vectors. This pattern matches failures seen in the 2023 indictment of REvil affiliates where financial operational reuse enabled law enforcement correlation.

Further charges and additional arrests remain possible once seized devices yield new indicators. Australian investigators have shared IOCs with international partners through existing Five Eyes channels.