# Shai-Hulud npm Supply-Chain Worm: Two Alleged TeamPCP Members Charged by AFP/FBI

> The Australian Federal Police and FBI charged two Western Australian men, Louis Michael Gaebler (23) and Ruben Ian Thomson (21), over their alleged roles in TeamPCP, the cybercrime syndicate behind the self-propagating "Shai-Hulud" npm supply-chain worm. Since first appearing in September 2025, successive worm waves (Shai-Hulud, "Sha1-Hulud: The Second Coming," and a May/August 2026 "Mini Shai-Hulud" resurgence) have compromised hundreds of npm/PyPI/GitHub Actions packages, harvested 500,000+ credentials, and exfiltrated at least 300GB of data from over 1,000 organizations, including OpenAI, GitHub, LiteLLM, Aqua Trivy, Checkmarx KICS, and TanStack.

- **Published:** 2026-08-28T00:00:00Z
- **Last reviewed:** 2026-08-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2186
- **ID:** TL-2026-2186
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Shai-Hulud is a self-propagating software supply-chain worm first documented by security researchers (including ReversingLabs) on 15 September 2025, when trojanized versions of @ctrl/tinycolor and dozens of other npm packages began shipping a malicious postinstall script (bundle.js). On execution, bundle.js downloaded and ran TruffleHog — a legitimate open-source secret-scanning tool — to sweep the host filesystem and cloud instance-metadata endpoints (AWS/GCP/Azure) for npm tokens, GitHub credentials, SSH keys, and other secrets, then published the harvested material to public GitHub repositories described as "Shai-Hulud" and to a webhook.site endpoint. Where the harvested secrets included additional valid npm publish tokens, the worm automatically republished trojanized versions of every package reachable by that token, turning each new infection into a fresh propagation vector without further attacker interaction. CISA issued an alert on the widespread compromise on 23 September 2025.

A second wave, "Sha1-Hulud: The Second Coming," surfaced in November 2025, compromising 700+ npm packages and creating more than 27,000 attacker-controlled GitHub repositories; this version added a self-hosted GitHub Actions runner and a malicious workflow (triggered on the `discussion` event) that executed attacker-supplied shell commands via `${{ github.event.discussion.body }}`, giving the worm a lightweight, registry-independent command channel. The syndicate behind the campaign, later attributed by the AFP/FBI as "TeamPCP," expanded operations across npm, PyPI, Docker Hub, GitHub Actions, and OpenVSX, backdooring projects including the Trivy vulnerability scanner (Aqua Security), the KICS IaC scanner (Checkmarx), and the LiteLLM AI gateway; CloudSEK reported 78,330 secrets exfiltrated from 2,186 organizations' CI/CD pipelines in a single five-day window in March 2026, and Aikido separately reported LiteLLM-linked secrets harvested from 434,000 CI/CD pipelines across 2,500+ organizations. A "Mini Shai-Hulud" resurgence in May 2026 compromised 160+ packages in roughly 24 hours, including 42 packages in the @tanstack/* scope — notably @tanstack/react-router, which has 12M+ weekly downloads — and coincided with confirmed data theft from OpenAI. A further wave on 4 August 2026 compromised 400+ npm packages, including keyv and cacheable, three weeks before the arrests.

On 26 August 2026, the AFP, FBI, and Western Australia Police Force charged Louis Michael Gaebler (23, of Mandurah) with six computer-crime offences and Ruben Ian Thomson (21, of Cottesloe) with eight offences including unauthorised data modification, supplying/possessing data with intent to commit a computer offence, failing to comply with a section 3LA order, and dealing with proceeds of crime exceeding AUD $100,000. Thomson is alleged to have led TeamPCP under the handle "Ellis" until stepping back from active leadership around March 2026. Both appeared at Perth Magistrates Court on 27 August 2026 after AFP searches of properties in Cottesloe, Hamilton Hill, and Mandurah. The AFP attributes over 1,000 compromised organisations, 500,000+ stolen credentials, and at least 300GB of exfiltrated data to the syndicate, with global remediation costs estimated in the hundreds of millions of dollars. Analysts caution the arrests do not close the underlying supply-chain exposure: TeamPCP's worm source code has reportedly circulated on cybercrime forums, and organizations that have ever installed an affected package remain at risk from previously exfiltrated credentials.

## MITRE ATT&CK

- T1588.002 Obtain Capabilities: Tool
- T1583.006 Acquire Infrastructure: Web Services
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1098 Account Manipulation
- T1036 Masquerading
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1528 Steal Application Access Token
- T1199 Trusted Relationship
- T1005 Data from Local System
- T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
- T1567 Exfiltration Over Web Service

## Sources

- [Shai-Hulud worm arrests: What you need to know](https://www.reversinglabs.com/blog/shai-hulud-worm-arrests-what-you-need-to-know)
- [Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks](https://thehackernews.com/2026/08/alleged-teampcp-hackers-charged-in.html)
- [Two alleged TeamPCP hackers arrested over global supply chain attacks](https://www.helpnetsecurity.com/2026/08/27/alleged-teampcp-hackers-arrested-australia/)
- [Shai-Hulud hackers: two men charged over TeamPCP's global supply chain crime spree that hit OpenAI, and thousands more](https://www.bitdefender.com/en-us/blog/hotforsecurity/shai-hulud-hackers-charged-teampcps)
- [Australian Arrests Allegedly Disrupt TeamPCP, but the Shai-Hulud Threat Persists](https://www.truesec.com/hub/blog/australian-arrests-allegedly-disrupt-teampcp)
- [500+ npm Packages Compromised in Ongoing Supply Chain Attack 'Shai-Hulud'](https://www.truesec.com/hub/blog/500-npm-packages-compromised-in-ongoing-supply-chain-attack-shai-hulud)
- [Two Arrests, One Supply-Chain Attack, and a Lot of Stolen Credentials](https://securityaffairs.com/197929/security/two-arrests-one-supply-chain-attack-and-a-lot-of-stolen-credentials.html)
- [FBI: TeamPCP Compromised Dev Tools to Steal Cloud Credentials](https://securityaffairs.com/194741/cyber-crime/fbi-teampcp-compromised-dev-tools-to-steal-cloud-credentials.html)
- [Australian cops cuff alleged TeamPCP masterminds](https://www.theregister.com/security/2026/08/28/australian-cops-cuff-alleged-teampcp-masterminds/5293157)
- [TeamPCP arrests don't fix the supply chain risk they exposed](https://www.aikido.dev/blog/teampcp-arrested-supply-chain)
- [Widespread Supply Chain Compromise Impacting npm Ecosystem](https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem)
- [Shai-Hulud npm Supply Chain Attack](https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack)
- [The Shai-Hulud 2.0 npm worm: analysis, and what you need to know](https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/)
- [Sha1-Hulud / Shai-Hulud: Full Technical Dissection of TeamPCP's Self-Propagating Supply Chain Worm](https://phoenix.security/sha1-hulud-shai-hulud-worm-analysis-persistence-iocs/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2186