Two alleged TeamPCP members arrested and charged after months of software supply-chain chaos

TeamPCP exploited the inherent trust organizations place in open-source software by injecting malicious code directly into widely-used libraries such as TanStack and UiPath, turning legitimate dependencies into attack vectors. This supply chain attack demonstrates how a single compromised package can cascade across hundreds of thousands of downstream users and systems simultaneously. The scale of credential exposure and the millions spent in cleanup underscore that organizations often lack sufficient controls to detect or respond to tampered third-party code. Investigators were ultimately able to identify suspects through poor operational security — leaked passwords and publicly linked online profiles — highlighting that attackers are not infallible, but the damage is done long before attribution occurs.