Australian authorities have arrested and charged two alleged members of TeamPCP, a hacking group accused of infecting more than 1,000 organisations worldwide through supply-chain attacks. The arrests matter because the group’s malware spread through widely used open-source software and development systems, potentially exposing large volumes of credentials and private data.

Police said the two Western Australian men face 14 charges between them; if convicted, one could receive more than 20 years’ imprisonment and the other more than 10. TeamPCP’s Shai-Hulud worm compromised software packages, stole credentials from infected systems and used them to spread into further packages, including after the compromise of the Trivy vulnerability scanner; infected machines contacted a resilient control mechanism roughly every 50 minutes.