NewsHive
CONTACT USANALYST PORTAL →
securityBACKGROUND

TeamPCP Supply Chain Campaign: Activity Through 2026-05-17, (Mon, May 18th)

BACKGROUND
1 SIGNALFIRST DETECTED 18 May 2026
Narrative synthesis pending — 1 signal collected.
How the story developed
18 May
9.2
Other feeds and industry voices
25 May
TeamPCP Supply Chain Campaign: Activity Through 2026-05-24, (Mon, May 25th)

TeamPCP now operates across three package ecosystems in parallel, it reached GitHub&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s own internal codebase, it trojanized an officially

REPORT · WHAT · SANS Internet Storm CenterOPEN STORY
27 Apr
TeamPCP Supply Chain Campaign: Update 008 - 26-Day Pause Ends with Three Concurrent Compromises (Checkmarx KICS, Bitwarden CLI Cascade, xinference PyPI), CanisterSprawl npm Worm Identified, and Tier 1 Coverage Returns, (Mon, Apr 27th)

This update succeeds&&#x23&#x3b;x26&#x3b;&#x23&#x3b;xc2&#x3b;&&#x23&#x3b;x26&#x3b;&#x23&#x3b;xa0&#x3b;TeamPCP Supply Chain Campaign Update 007, published April 8, 2026, which left

REPORT · WHAT · SANS Internet Storm CenterOPEN STORY
8 Apr
TeamPCP Supply Chain Campaign: Update 007 - Cisco Source Code Stolen via Trivy-Linked Breach, Google GTIG Tracks TeamPCP as UNC6780, and CISA KEV Deadline Arrives with No Standalone Advisory, (Wed, Apr 8th)

This is the seventh update to the TeamPCP supply chain campaign threat intelligence report,&&#x23&#x3b;x26&#x3b;&#x23&#x3b;xc2&#x3b;&&#x23&#x3b;x26&#x3b;&#x23&#x3b;xa0&#x3b;"When

REPORT · WHEN · SANS Internet Storm CenterOPEN STORY
7 Aug
TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign

A new analysis has uncovered that the threat actor tracked as TeamPCP has been active on the cybercrime scene as far back as 2020, indicating the group has been compromising

REPORT · WHAT · The Hacker NewsOPEN STORY
11 May
TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks After KICS Supply Chain Attack

Checkmarx has confirmed that a modified version of the Jenkins AST plugin was published to the Jenkins Marketplace. "If you are using Checkmarx Jenkins AST plugin, you need to

REPORT · WHO · The Hacker NewsOPEN STORY
Sources
SANS Internet Storm Center

NewsHive monitors these sources continuously. All signal titles above link to the original reporting.

Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →