TeamPCP arrests won't rotate your CI credentials

Two men in Western Australia were charged this week over the software supply chain attacks that spent most of 2026 poisoning open-source packages. Good. Now go rotate your tokens anyway, because the TeamPCP arrests close a police file, not your exposure window. If your build pipeline touched any of the affected packages, the credentials it held are still sitting in somebody's dump.

What actually happened

The Australian Federal Police charged a 21-year-old from Cottesloe and a 23-year-old from Mandurah on 26 August with a combined 14 offences, after search warrants in Perth. The investigation ran jointly with the Western Australia Police Force and in parallel with the FBI. Charges include possessing and supplying data for computer offences, unauthorised modification of data, and — for the younger man — dealing with proceeds of crime worth $100,000 or more. Both were listed to appear in Perth Magistrates Court the next day.

The scale is the part that matters to you. Police allege the group's malicious code potentially compromised more than a thousand organizations worldwide. BleepingComputer reports roughly half a million stolen credentials and at least 300GB of exfiltrated data, with global remediation costs estimated in the hundreds of millions. The victim list reads like a dependency tree: Trivy, LiteLLM, Telnyx, TanStack, Mistral AI, OpenAI, GitHub, SAP, and the European Commission. TechCrunch adds Mercor to that list.

We wrote about the LiteLLM leg of this in August: a compromised Trivy build sat inside a CI pipeline for about 20 days, and two tainted PyPI releases were live for 40 minutes. That was one branch of the same tree.

Why it matters for your business

An arrest is a legal event. A stolen ANTHROPIC_API_KEY is a technical one, and it does not expire when someone is charged. Half a million credentials went somewhere before August 26, and credential dumps get resold, replayed, and stuffed for years.

So treat this week's news as a deadline, not a resolution. Three moves, in order. Rotate every long-lived secret any CI runner has held since roughly February 2026 — publishing tokens, cloud keys, model provider keys, webhook signing secrets. Check whether your build ever installed the affected versions, which means you need an install log going back six months; if you can't answer that question, that gap is the finding. Then remove the reason you'll do this again: swap stored static keys for short-lived OIDC credentials scoped to a single job.

The uncomfortable framing: your dependency risk is the transitive closure of everything your pipeline pulls, including your security tooling. TeamPCP's best entry point was a vulnerability scanner. Two fewer operators are working today. The technique is public and the tooling is cheap.

Sources: Australian Federal Police, BleepingComputer, TechCrunch.