Two men charged over malicious code planted in an open source repository

The Australian Federal Police said on 27 August 2026 that two men from Western Australia have been charged with 14 offences between them. The charges follow an investigation carried out together with the Western Australia Police Force and the FBI. Police allege the two were principal participants in TeamPCP, a group that inserted malicious code into software hosted in an open source repository. Other developers then pulled that software in, and the code made it possible to steal credentials and authentication data.

Authorities estimate that more than 1000 organisations may have been compromised. More than 500,000 credentials and at least 300 gigabytes of data are said to have been stolen. Police describe TeamPCP as an alleged global cybercrime syndicate.

What this means for you if you pull code from open source repositories

A charge does not remove code that has already been downloaded. If you built anything during that period, the dependencies are still sitting in your lock files, and they keep running whatever happens in a courtroom. Our assessment is that the police case is a reminder and not a clean-up. Working out what you actually pulled in is still your job.

What makes this kind of attack hard is that the theft happens somewhere other than the break-in. The credentials taken have not necessarily been used yet. An estimate of more than 500,000 sets means a hit against you may surface long after the package itself is gone. If you have not rotated the keys and tokens that were available inside your build environment, that part of the work is outstanding.

Berigo recommends

• Go through the lock files in your projects, and write down which package versions are actually built in.
• Rotate keys, tokens and passwords that have been available inside the build environment, and make it a standing routine.
• Pin builds to specific versions, so that a build does not fetch the newest release of a package on its own.
• Separate the build environment from production, so that a package running code during a build cannot reach further.
• Ask your suppliers for a list of software components, and get the requirement into the contract.