Australian Police Charge Two Men Over TeamPCP, the Trivy Supply-Chain Campaign That Stole 500,000 Credentials

Ars Technica·medium signalXBlueskyLinkedInCopy link

The AFP charged Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, on August 26 with 14 combined offenses after Perth search warrants executed with WA Police and the FBI. Authorities say TeamPCP's poisoned open-source components reached more than 1,000 organizations, enabled theft of over 500,000 credentials and at least 300GB of data, and left remediation costs in the hundreds of millions. The campaign exploited a misconfigured Trivy workflow in late February and pushed a malicious Trivy release through every distribution channel simultaneously on March 19.