Threat Actor Attribution and OSINT

A misconfigured GitHub Actions workflow handed TeamPCP the token that poisoned five ecosystems

Two alleged TeamPCP operators are in custody, and Flare's account of the March 2026 chain puts the root cause inside Aqua Security's Trivy build workflow, where a leaked service-account token survived an incomplete rotation.