TEAMPCP

CVSS 10.0 critical unauthenticated RCE in React Server Components + Next.js (CVE-2025-55182 + CVE-2025-29927). Single crafted POST triggers server-side deserialization → arbitrary Node.js code execution. TeamPCP mass-exploited at scale against Docker, Kubernetes, Ray, Redis deployments globally. Port 666 used in exploitation operations. This campaign built the criminal cloud infrastructure deployed in the 2026 supply chain series. Simultaneously, operative MegaGame10418 exploited a PwnRequest vulnerability in Trivy's CI on February 27, 2026, exfiltrating Aqua Security's Personal Access Token — the key that unlocked every campaign that followed.

xinference 2.6.0–2.6.2 targeting AI inference infrastructure. Fire-and-forget: no persistence, no encryption — data gzipped as love.tar.gz, POSTed raw with custom header X-QT-SR: 14 to whereisitat.lucyatemysuperbox.space. Full AWS Sig4 implementation queries Secrets Manager + SSM Parameter Store directly. Exhaustive crypto wallet sweep including Solana validator keypairs. First decoded line of payload: # hacked by teampcp. Plot twist: @pcpcats publicly denied responsibility on Twitter — "if you're this copycat using our team name, DM me." First time a TeamPCP-attributed payload was publicly disputed by the group itself. Possible copycat, false flag, or deniability operation. KICS Docker images also compromised the same day (Socket.dev).

Most novel vector yet: malware detected Claude Code's GitHub integration running on an infected SAP developer machine and hijacked it — committing as claude@users.noreply.github.com with no token theft required. 11:23 UTC malicious commit 0a3dd44d. Modified release-please.yml to extract short-lived npm OIDC tokens — stripped SLSA provenance. By 11:25 UTC four packages published: @cap-js/sqlite@2.2.2, @cap-js/postgres@2.2.2, @cap-js/db-service@2.10.1, mbt@1.2.48. 12:12 UTC: persistence deployed via .claude/settings.json SessionStart hook re-running .vscode/setup.mjs dropper on every future IDE launch. Payload: preinstall hook → setup.mjs dropper; obfuscation upgraded to 49,093-entry string table + PBKDF2/SHA256 S-box cipher + 6 gzip blobs; 39 target paths including ~/.claude.json and ~/.kiro/settings/mcp.json. Python memory dumper targets Runner.Worker process in CI. Self-propagation: enumerates npm tokens → injects into accessible packages → republishes as package-updated.tgz. Repo descriptions read: "A Mini Shai-Hulud has Appeared" (Dune universe naming). SAP emergency response 13:33 UTC; clean releases by 13:45.

Three ecosystems hit simultaneously on April 30. Root cause: an Intercom developer installed pyannote-audio, which pulled in compromised lightning@2.6.2 (PyPI) as a transitive dependency — giving attackers a GitHub token. From there: intercom-client@7.0.4 (npm, ~360K weekly downloads) trojanized via compromised GitHub account nhur using fake Dependabot commit conventions. Within hours: intercom/intercom-php@5.0.2 (Packagist, ~285K installs/month) converted to a Composer plugin executing on post-install-cmd. All three share the same 11.7 MB obfuscated router_runtime.js payload — bootstrapped by Bun v1.3.13 downloaded from GitHub, exfiltrating via GitHub API (RSA-encrypted) with fallback to zero.masscan.cloud:443. New targets: crypto wallets (Bitcoin, Monero, Exodus, Ledger), VPN configs (NordVPN, ProtonVPN), Discord/Slack sessions. Repository poisoning injects .claude/router_runtime.js + .claude/settings.json into up to 50 branches per repo, committed as claude@users.noreply.github.com. Payload strings: "A Mini Shai-Hulud has Appeared", "EveryBoiWeBuildIsAWormyBoi", "Exiting as russian language detected!" (same anti-attribution geofence as CanisterWorm). Attribution: onion link in GitHub disclosures claimed TeamPCP + LAPSUS$ involvement.