Reported by 1 outlet
TeamPCP Supply Chain Assault Widens — OpenAI Breach Confirmed, node-ipc Compromised, BreachForums Contest Launched
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
TeamPCP Supply Chain Assault Widens — OpenAI Breach Confirmed, node-ipc Compromised, BreachForums Contest Launched
bleepingcomputer.com · 152d ago · May 15th, 2026
TeamPCP's Mini Shai-Hulud supply chain campaign continues expanding. OpenAI confirmed two employees' devices were breached through compromised TanStack packages, forcing rotation of code-signing certificates across macOS, Windows, iOS, and Android. macOS users must update OpenAI desktop apps before June 12. TeamPCP is also advertising nearly 450 Mistral AI repositories for $25,000 on hacker forums. Separately, the node-ipc npm package (822K weekly downloads) was compromised through a hijacked dormant maintainer account, with versions 9.1.6, 9.2.3, and 12.0.1 packing credential-stealing malware that exfiltrates AWS, Azure, GCP, and SSH keys via covert DNS TXT queries.
TeamPCP and BreachForums have launched a $1,000 gamified contest rewarding participants for using the open-source Shai-Hulud tool to compromise open-source packages, with scoring based on download counts of trojanized packages. The contest spans npm, PyPI, GitHub Actions, Docker, and OpenVSX. Meanwhile, RubyGems.org suspended new account registrations after bot accounts pushed 500+ malicious packages in a parallel supply chain attack.