Product1 publisher3 min readPublished
Google's undercover analyst watched TeamPCP poison packages from inside its core chat
Austin Larsen of Google's threat intelligence group says a Mandiant persona sat in TeamPCP's inner circle from almost the start of the campaign. For the companies the group breached, that infiltration was the warning system.
The Product Desk · Product desk
What happened
- Google's threat intelligence group said at LABScon that an undercover Mandiant analyst was invited into TeamPCP's inner circle in March as one of about 12 members with access to a core chat the group called CanisterWorm.
- The group tainted hundreds of open-source programs with its malware and stole developer accounts to keep the cycle running, breaching more than a thousand companies in total.
- Victims of the cascade included GitHub, the data contracting firm Mercor, and employee devices at OpenAI and the European Commission, with many others unnamed in public reporting.
- Australian police, assisted by the FBI, arrested Ruben Ian Thomson and Louis Michael Gaebler late last month and charged them with hacking crimes, after Google passed identifying details to law enforcement.
- Google also received intelligence from ShinyHunters, a cybercriminal group that had partnered with TeamPCP and later turned on it.
Compiled by The Product DeskSomething wrong?How this is made
Why it matters
- constraint No consuming team can reproduce this control. The access came out of a relationship built over many months with a specific person, so it cannot be bought at renewal, audited by a customer, or stood up in a sprint once a campaign is already running.
- exposure Anyone whose test for a poisoned dependency was a clean scanner run was relying on a layer that sat inside the victim list, which makes a green pipeline worth less as evidence than the dashboard implies.
- decision Each team now has to pick, in advance, the route by which an outsider's breach warning reaches it and who is allowed to act on that message overnight. Without it, an inside view held by a vendor never turns into a rollback.
- precedent A disclosure like this sets the expectation that the first credible notice about a poisoned release arrives months into a campaign, by email, from a threat intelligence vendor's analyst.
Work on that persona started before the group did. "One of our personas had been working for many months to build trust with one of the actors that was invited to join TeamPCP, and so was added to the group," Larsen told WIRED [6]. TeamPCP first appeared online in late 2025 [13], and the invitation into the inner circle came in March [8]. Many months of trust-building before March puts the start of that relationship at or before the group's first appearance [1]. "So essentially, almost day one, Mandiant was watching everything behind the scenes," Larsen said [7].
Read the list of poisoned upstream projects as a buyer. Starting this spring, TeamPCP compromised the open-source security scanner Trivy, the AI application programming interface tool LiteLLM, the web app library TanStack, the enterprise AI platform Mistral AI, and infrastructure at the web application security firm Checkmarx [14]. Two of those five supply security checking. A team whose control for a poisoned dependency was a clean Trivy run in CI was leaning on a tool the campaign had already reached.
The group also deployed a worm called Mini Shai-Hulud, named for the sandworms in Dune, to automate the hacking and scale to more victims [16]. Take "hundreds" of tainted open-source programs [1] at 200 to 300, and set that against more than a thousand breached companies [2]: each poisoned package reached roughly three to five companies [2].
Larsen's account does not say how many of those companies Google warned, or how early each notice went out [3]. It does describe the monitoring as human work with more than one party in it. Michael Fletcher, a former Australian Federal Police analyst who now works in the threat research division of the Australian telecom firm Telstra, says he approached Larsen around that time about methods for monitoring the group's members and activities [18].
The view from the seat included the boasting. One TeamPCP member wrote in the leaked chats that the group had pulled off maybe the biggest supply chain compromise ever recorded in modern history [17].
So take the ten dependencies you would least like to be wrong about, and ask two questions about each. First, if a signed release of this package were poisoned tomorrow, would our own pipeline catch it, and in how many hours? Second, if a stranger knew before we did, by what route does that person reach us, and who is authorised to act on the message?
That gives four answers. Detectable and reachable: fine. Not detectable but reachable: you are living on someone else's undercover analyst, so the inbox needs a human reading it and the rollback needs to have been rehearsed. Detectable but unreachable: workable for code you wrote, weak for transitive dependencies you did not. Neither: you learn about it from a reporter.
Closing the first gap costs a serious slice of engineering time. Closing the second costs a monitored address and a practised rollback, and it is the half that Google's warnings to breach targets needed on the receiving end [3].
What to watch
- Whether Larsen's LABScon material or a later Google writeup attaches dates to when each breached company was warned.
- Court filings in the Australian prosecutions of Thomson and Gaebler, and what the undercover access contributed as evidence.
- Whether Trivy, LiteLLM, TanStack, Checkmarx or Mistral AI publish post-incident detail on how the poisoned releases got signed and shipped.