A Hacker Group Is Poisoning Open Source Code at an Unprecedented Scale
2026-05-21T20:52:11Z•86577b90109d426202128226b6eb34eaf3a6e8b34e9970e23ac85f0c1b41560c
GitHubcode-poisoningdependency-poisoningincident-responseopen-sourcerepository-compromisesoftware-integritysoftware-supply-chainsupply-chain-securityteamPCP
What happened
TeamPCP, a coordinated hacker group, is carrying out a large-scale software supply‑chain campaign that poisons open‑source code and dependencies across projects—GitHub is a known victim—and has impacted hundreds of organizations. The attacks undermine software integrity and create high downstream risk for any users of compromised repositories or packages.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- wired_security
- Record identifier
- 86577b90109d426202128226b6eb34eaf3a6e8b34e9970e23ac85f0c1b41560c
- Enrichment time
- 2026-05-21T20:52:11Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.