AFP charges two Perth men over poisoned packages police say reached 1000 organisations

The load-bearing phrase in the AFP release is "a small number of trusted software components" ^[7]. That is the whole mechanism. A poisoned release does not need to be popular to be everywhere; it needs to be resolved. Once it is in a lockfile or somewhere in a transitive closure, install-time and build-time code runs wherever the package is fetched, which in most shops is a CI agent holding registry tokens, cloud role credentials and signing material. The alleged haul matches that environment: user credentials and authentication materials ^[5]. AFP Commander Graeme Marshall described the second stage as impersonating legitimate users, bypassing security controls and reaching networks and cloud environments ^[13]. Stolen tokens are valid tokens.

Treat the impact figures as claims about someone else's telemetry. Police estimate more than 1000 organisations potentially compromised, more than 500,000 credentials taken and at least 300 gigabytes exfiltrated ^[6]. Divide it out and the average victim lost roughly 500 credentials ^[20] and about 300 megabytes ^[21]. That average is almost certainly not the shape of the distribution; a few build systems with wide reach would account for most of both totals. The qualifiers matter too, since "potentially" sits on the organisation count and "at least" sits on the bytes ^[6]. The ABC's own summary says hundreds of organisations while its body carries the police figure of more than 1000 ^[19]. For 1000 to mean 1000 intrusions rather than 1000 installs of a bad version, someone would have to publish per-organisation confirmation.

The charge sheet is the more useful document. Against the 21-year-old from Cottesloe: possessing data with intent, maximum three years; four counts of unauthorised modification of data with intent to commit a serious offence, five years; supplying data with intent, three years; failing to comply with a 3LA assistance order, ten years; and dealing with proceeds of crime worth $100,000 or more, twenty years ^[9]. The proceeds count carries four times the maximum of the heaviest computer offence charged, and the assistance-order count twice it ^[24]. On the face of that arithmetic, keeping the password is dearer than modifying the data. The 23-year-old from Mandurah faces the six computer counts and nothing further ^[10]. Police allege both men were principal participants paid in cryptocurrency, with the value still under investigation ^[8].

Scale shows up in the evidence pile rather than the theft. Investigators say they have already extracted 100 terabytes from devices seized at one address and expect much more ^[17], which is on the order of 330 times the exfiltration figure they have put on the syndicate ^[23]. The magistrate refused Ruben Thomson bail on the concern that he could tamper with evidence, and his lawyer withdrew the application ^[15]. Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, were named by the ABC ^[11], and the FBI's Assistant Law Enforcement Attache Dave Andish identified Thomson as the alleged leader of the group known as TeamPCP ^[12]. What that adds up to, from a defender's seat, is a case whose critical path runs through forensic extraction, with attribution trailing well behind it.