Australian Federal Police arrested two men this week accused of operating as members of TeamPCP, the hacking group behind the Shai-Hulud supply-chain worm that has infected more than 1,000 organizations since December. The AFP statement says the men, from the Western Australian towns of Cottesloe and Mandurah, face 14 charges in a joint operation with the FBI and Western Australia Police. If convicted, one faces more than 20 years in prison, the other more than 10.
Ars Technica’s coverage notes that KrebsOnSecurity independently identified both defendants through its own investigation, which also documented the operational mistakes that led investigators to them.
How Shai-Hulud spread
TeamPCP’s signature move was a self-propagating worm through open-source software ecosystems. The mechanics were simple and effective: compromise a package, let the malware harvest credentials for other packages from the memory of infected machines, then use those credentials to inject the worm into the next round of package updates. Every developer who pulled a compromised package and ran it through their CI/CD pipeline became the next distributor.
The cascade effects were what made this campaign exceptional. When the Trivy vulnerability scanner was compromised, the infection moved downstream into KICS, the Telnyx Python SDK, and LiteLLM after their maintainers ran infected tooling in their own pipelines. A security scanner becoming an attack vector is a particular kind of irony, and it resulted in terabytes of credentials and private data being stolen, as Ars reported earlier this month.
This is not the first worm to run through package registries, but the scale separates it from its ancestors. Earlier incidents, like the 2021 UA-Parser-JS hijack and the various single-package credential stealers, burned out in days once maintainers rotated keys. Shai-Hulud’s credential-harvesting loop meant each new victim supplied the fuel for the next round of infections, so the campaign compounded instead of decaying. That property, more than any individual exploit, is what security teams should absorb: a supply-chain worm is a self-sustaining process, and containment requires cutting the credential supply rather than blocking one package.
Takedown-resistant command and control
One design decision set Shai-Hulud apart from earlier npm worms. The malware reported to control servers whose addresses were resolved through an Internet Computer Protocol canister, a form of smart contract. Infected machines checked in every 50 minutes, pulling URLs that the operators could rotate at will. There was no fixed C2 infrastructure to seize, which is part of why the campaign ran for nine months until the arrests rather than being disrupted in weeks.
The worm’s name is a Dune reference, and for once the naming fits the behavior. Anything the sandworm touched, it colonized.
How they were caught
KrebsOnSecurity’s reporting on the defendants describes a familiar pattern: capable malware, careless operators. The details that connected the two men to the campaign reportedly came from ordinary mistakes, reusing identifiers across accounts, leaking personal details in communications, and behavior visible to investigators once they knew where to look. This is the norm rather than the exception in takedown cases. Operational security failures catch more hackers than forensic breakthroughs do, and groups whose members grew up swapping tips in Discord servers rarely maintain the discipline of older organized-crime crews.
For defenders, the useful part of the story is the timeline. Nine months of a global campaign ended not through a technical kill switch but through police work that started with those mistakes. Assume the technical defenses, scoped credentials, ephemeral runners, dependency audits, are the layer that keeps you safe while the legal system does its slow work.
What the arrests do and do not fix
Two arrests in Australia do not necessarily end the campaign. Group takedowns usually only stick when infrastructure and finances are seized alongside the people, and the canister-based C2 means the worm’s control plane may still be operational. Organizations should treat the technical threat as live and keep patching and auditing package dependencies as before.
The charges still matter. Deterrence in supply-chain attacks has been nearly nonexistent because attribution is slow and extradition is slower. A case with a 20-year potential sentence signals that operating open-source worms is not a consequence-free activity, even for participants who never touch a keyboard in the countries they attack.
Protecting your own pipelines
The recurring lesson of Shai-Hulud is that credential scope decides blast radius. The worm spread by harvesting tokens that could publish to other packages, so limiting what each credential can do limits propagation. Concretely:
- Scope publish tokens to single packages and short lifetimes, and require OIDC-based publishing where the registry supports it, so no long-lived secret exists to steal.
- Treat CI runners as untrusted territory. Ephemeral runners with no access to stored credentials stop the memory-harvesting step that powered this worm.
- Pin and audit dependencies. The Trivy case shows that your security tooling belongs in that audit, not just your application packages.
Aikido Security researcher Charlie Eriksen told KrebsOnSecurity that the group lacked the operational discipline this level of capability used to require. His explanation was blunt: “LLMs have compressed that gap significantly.” A capable worm no longer needs a capable operator, which raises the stakes on the boring hygiene above.