Malicious Code Injected into Open-Source Libraries Compromises 1,000+ Organizations
TeamPCP exploited the inherent trust organizations place in open-source software by injecting malicious code directly into widely-used libraries such as TanStack and UiPath, turning legitimate dependencies into attack vectors. This supply chain attack demonstrates how a single compromised package can cascade across hundreds of thousands of downstream users and systems simultaneously. The scale of credential exposure and the millions spent in cleanup underscore that organizations often lack sufficient controls to detect or respond to tampered third-party code. Investigators were ultimately able to identify suspects through poor operational security — leaked passwords and publicly linked online profiles — highlighting that attackers are not infallible, but the damage is done long before attribution occurs.
Tactical Insight
Immediate actions
- Audit all current open-source dependencies against known-compromised package versions and remove or pin them to verified safe releases.
- Scan your software bill of materials (SBOM) for any packages associated with the affected libraries (TanStack, UiPath integrations, Trivy) and treat them as untrusted until verified.
Long-term improvements
- Mandate the generation and maintenance of a comprehensive SBOM for every application so dependency risks can be rapidly assessed during future incidents.
- Implement a private, vetted package registry or artifact repository (e.g., Artifactory, Nexus) to proxy and vet all open-source packages before they reach development pipelines.
- Establish a formal third-party and open-source risk management policy that includes periodic integrity checks and code-signing verification for all external dependencies.
Detection measures
- Deploy runtime application self-protection (RASP) or behavioural monitoring to detect anomalous activity originating from third-party library code.
- Integrate software composition analysis (SCA) tools into CI/CD pipelines to automatically flag newly published vulnerabilities or integrity mismatches in dependencies before deployment.