Perth charges leave the TeamPCP rotation list exactly where the FBI left it on July 2

Rotation is load-bearing here because the campaign ran on credentials rather than exploits. TeamPCP took publishing credentials from trusted open-source projects and pushed poisoned versions out through those projects' own release channels, across GitHub Actions, Docker Hub, npm, PyPI and OpenVSX ^[10]. Each compromise paid for the next: credentials stolen from Trivy were turned on Checkmarx KICS actions days later ^[11].

LiteLLM's own build pipeline installed Trivy without pinning it to a verified version, so the poisoned scanner harvested LiteLLM's publishing token, and the actor used that token to push backdoored LiteLLM releases in late March [c12a]. LiteLLM routes requests across LLM providers, which is where an organization's provider keys are consolidated [c12b]. Anything a poisoned build could read while it executed was reachable, so the token list runs wider than the artifact list [c12a].

Hudson Rock attributed 118,829 CI runner dumps to 2,488 corporate domains, taken from a 153GB archive of the attackers' own exfiltrated data ^[16]. Divide it out: roughly 48 runner dumps per affected domain ^[1]. That ratio makes cleanup a per-pipeline exercise.

The police figures are not independent of vendor telemetry. Unit 42 published the same two figures in March, hedged as what the actor "may have exfiltrated" ^[14], and FBI Cyber Division Assistant Director Brett E. Leatherman used the same order of magnitude, saying the malicious code "potentially compromised more than a thousand organizations worldwide" ^[5]. SecurityWeek reports the group deployed the Mini Shai-Hulud worm, and likely the original, to automate credential theft and self-propagation across package registries ^[22].

The charge sheet is narrower than the campaign. The Cottesloe man, 21, faces one count of possessing data with intent, four counts of unauthorized modification, one count of supplying data, one count of failing to comply with a section 3LA order, and one count of dealing with proceeds of crime worth $100,000 or more ^[6]. The Mandurah man, 23, faces six counts and no proceeds count ^[7]. The 3LA offence carries a 10-year maximum, the proceeds count 20 years ^[8]. SecurityWeek puts Thomson's exposure at 3 to 20 years per charge and Gaebler's most serious counts at a five-year maximum ^[21], and describes losses attributed to the syndicate in the hundreds of millions of dollars ^[24]. Police allege both men were principal participants paid in cryptocurrency, in amounts still being worked out ^[3].

The seized devices are what could turn reconstructed exposure into named victims. The AFP says the forensic examination continues and that further arrests and charges have not been ruled out ^[20].