What happened
The Australian Federal Police charged two Western Australian men with a combined 14 offences over their alleged role in TeamPCP, the cybercrime group behind the March 2026 compromise of the open-source security scanners Trivy and Checkmarx KICS and the AI gateway LiteLLM. Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21, appeared in Perth Magistrates Court on August 27, a day after the AFP and Western Australia Police executed search warrants in Cottesloe, Hamilton Hill and Mandurah and seized devices for forensic analysis.
Police allege the pair were principal participants who were paid in cryptocurrency, with the value still under investigation. The syndicate's method was to steal publishing credentials from trusted open-source projects and push poisoned versions out through the projects' own release channels, spanning GitHub Actions, Docker Hub, npm, PyPI and OpenVSX. The compromise of one project supplied credentials for the next: credentials from the Trivy compromise were used against KICS days later, and LiteLLM's build pipeline, which installed Trivy without pinning a verified version, lost its publishing token to the poisoned scanner.
The AFP said the malicious code potentially compromised more than 1,000 organizations worldwide, enabled the theft of more than 500,000 credentials and led to the exfiltration of at least 300 gigabytes of data. The charges carry serious weight under the Crimes Act: the section 3LA count alone carries up to 10 years' imprisonment, and the proceeds-of-crime count up to 20 years.
Why this is a GRC story
This is third-party and supply chain risk in its purest form. The tools organizations trust to scan their own code for vulnerabilities were the attack vector. Your security tooling is part of your attack surface, and this campaign shows the chain reaction when one open-source project loses control of its release pipeline.
The operational lesson is concrete: pin dependencies to verified versions, treat CI/CD secrets and publishing tokens as crown jewels, and rotate them on a schedule and after any suspected exposure. The FBI's July 2 advisory told impacted organizations to treat exfiltrated data and credentials as a persistent risk and to rotate all CI/CD secrets, publishing tokens and cloud credentials accessible during the exposure windows. Credentials stolen in March may still be in use.
What to watch
Watch the court proceedings, since none of the 14 charges names a specific compromised project, and whether further arrests follow as the forensic analysis of the seized devices progresses. The campaign's scope keeps growing with each researcher's report, so affected organizations should not assume the exposure window is closed.
For compliance teams, this case is a reminder to verify what your software supply chain actually trusts: who can publish to your registries, whether your builds pin exact versions, and whether you can detect a poisoned artifact in your pipeline before it ships to customers.
Attribution: Analysis based on The Hacker News' reporting, the AFP joint media release and related public reporting. This article is original commentary, not a repost of the source material.