Australian police, with FBI assistance, arrested the alleged masterminds behind the Shai-Hulud worm and related supply chain attacks.
Australian law enforcement, working with the FBI, arrested suspects alleged to be the masterminds behind the Shai-Hulud worm and other software supply chain attacks. The group is referred to as TeamPCP. The report did not specify charges, the number of suspects arrested, or affected victims.
Australian Federal Police, with FBI support, arrested two alleged TeamPCP members behind supply-chain attacks that compromised over 1,000 organizations.
The AFP charged two Western Australian men, identified by media as Ruben Ian Thomson (21) and Louis Michael Gaebler (23), with 14 combined offences including unauthorized data modification and dealing in criminal proceeds. TeamPCP is blamed for poisoning open-source software releases including Trivy, LiteLLM, and the mini Shai-Hulud worm campaign, exposing over 500,000 credentials and at least 300 GB of data. Victims included the European Commission and GitHub, with remediation costs estimated in the hundreds of millions of dollars. Researchers from Flare traced one suspect through leaked passwords, a GitHub alias, and a Steam profile.
CASHEWS preprocessor boosts LLM-based malicious npm package detection, raising coverage to 98.8-100% and cutting false negatives by up to 18.6 points.
Researchers present CASHEWS, a JavaScript preprocessor for LLM-based malicious package detection that deobfuscates code iteratively, extracts bundled modules and dynamically executed code, identifies malicious sinks, and computes backward slices to produce compact detector input. Threat actors evade LLM detectors by exploiting limited context windows with high token-density obfuscation and by bundling malicious code with benign packages, as seen in supply-chain attacks such as Shai-Hulud. Across 512 large package files, two scanner types, and three LLMs, CASHEWS raised analysis coverage from 69.1-85.7% to 98.8-100% and reduced false-negative rates by up to 18.6 percentage points. Median preprocessing time is 30 seconds while net analysis cost drops 34.6%.
GitGuardian now deploys honeytoken decoy AWS credentials across developer fleets via MDM, generating high-fidelity alerts when infostealers test stolen credentials.
GitGuardian extended its honeytoken platform so decoy AWS credentials can deploy fleet-wide to developer laptops through existing MDM tooling, with deleted decoys automatically replaced at the next sync. When a harvester tests a decoy, the platform logs the API call in the controlling AWS account and raises an incident naming the source machine and file, routed via email, Slack, Teams, ServiceNow, or webhooks. The capability responds to infostealers such as Shai-Hulud that scan entire filesystems and validate stolen credentials within seconds. GitGuardian is building decoys for Kubernetes and package registry credentials using random, structure-free identifiers that resist detection.