Australian Federal Police have arrested two Perth men, aged 21 and 23, accused of being principal figures in TeamPCP, a cybercrime group linked to major software supply-chain attacks. The arrests, assisted by the FBI, matter because the alleged campaigns targeted widely used open-source software and may have exposed organisations worldwide to stolen credentials, data theft and destructive malware.

The investigation began in April 2026 after threat-intelligence firms alerted Australian and US authorities to malicious code being inserted into open-source repositories. Authorities link the group to attacks including the Shai-Hulud npm worm and an earlier compromise involving the Trivy security scanner; they estimate more than 1,000 organisations may have been affected, over 500,000 credentials stolen and at least 300GB of data exfiltrated, with remediation costs potentially reaching hundreds of millions of dollars. Devices and data were seized for forensic examination, and police say further arrests or charges remain possible.