Signal · E1 · Long-form

TeamPCP Are Back: The Shai-Hulud of Supply Chain Attacks

Name: TeamPCP Are Back: The Shai-Hulud of Supply Chain Attacks
Uploaded: 2026-05-03
Channel: Asaf Nakash
Description: A security scanner trusted by thousands of companies was hijacked. Within 60 seconds, 46 packages were compromised. 40,000 people had their biometric data

Published May 3, 2026 · Curated by Asaf Nakash

A security scanner trusted by thousands of companies was hijacked. Within 60 seconds, 46 packages were compromised. 40,000 people had their biometric data stolen — faces, voices, government IDs. The European Commission was breached. Then the attackers vanished for 26 days. On April 29th, they came back.

Chapters

Sources

Primary Aqua Security — TeamPCP Disclosure (March 2026)

Originating disclosure of the TeamPCP Trivy tag-rewriting attack; first detailed technical writeup

Verified 2026-04-29
Primary Checkmarx — KICS Advisory & Steganographic C2

Primary analysis of the steganographic command-and-control hidden in WAV files

Verified 2026-04-29
Corroborating StepSecurity — Supply Chain Analysis: CanisterWorm + 46 packages

Detailed forensic timeline of the 60-second package compromise and downstream propagation

Verified 2026-04-29
Primary CERT-EU Advisory — European Commission Breach Confirmation

Official EU CSIRT confirmation of the European Commission breach (340GB exfiltrated)

Verified 2026-04-29
Primary CISA — KEV Catalog Addition & Federal Remediation Order

Federal CSIRT advisory adding the TeamPCP-exploited vulnerability to the KEV catalog with binding remediation deadline

Verified 2026-04-29
Corroborating Endor Labs — 'TeamPCP Isn't Done' Report (April 29 Return)

Threat-intel firm's analysis of the April 29 SAP npm package compromise marking TeamPCP's return after 26-day silence

Verified 2026-04-29
Primary Mercor Breach Disclosure (40K biometric records)

Affected company's official breach notification (4TB exfiltrated, 40,000 individuals' biometric data)

Verified 2026-04-29

How this was made. A.I. tools generated the animation, voice, and visual composition. The facts, sourcing, and editorial decisions came from a human. Every claim in this video links to a source above; every source was verified against its primary publication. The newsletter that started this story is at contextwindowsec.com.