The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave

Multi-ecosystem supply chain compromise by TeamPCP targets GitHub, NPM, and VSCode to steal credentials and establish persistence.

The ongoing software supply chain campaign targeting the open source ecosystem reemerged on May 19th, affecting NPM packages, GitHub Actions, and a VSCode extension.  The distributed malware was designed to harvest credentials, exfiltrate sensitive data, and establish persistent access on infected systems.

As the activity unfolded publicly, Wiz Research independently observed related malicious activity in real time across developer and CI/CD environments.

Based on infrastructure analysis, malware behavior, and operational overlaps identified during the investigation, Wiz attributes this activity to the threat actor known as “TeamPCP”.

Researchers have dissected a coordinated software supply chain attack campaign affecting multiple components within the developer ecosystem, including npm packages (prominently those in the@antvnamespace), GitHub Actions (e.gactions-cool/issues-helper) and a VSCode extension (nrwl.angular-consolev18.95.0).

Upon installation of the npm packages, the malicious code initiated a multi-stage infection chain designed to retrieve additional payloads from GitHub-hosted infrastructure. In several cases, the payloads were stored in orphaned GitHub commits, likely as an attempt to evade detection and maintain operational resilience. The malware then usedbunto install and execute secondary payloads responsible for credential theft and persistence.

The malware collected a wide range of sensitive artifacts from infected systems, including GitHub tokens, SSH keys, cloud credentials, browser-stored secrets, and other developer-related authentication material. Exfiltration occurred through attacker-created public GitHub repositories generated from the victim environment. Investigators observed repositories created with the description:

In addition to credential theft, the malware established persistence by installing a Python-based backdoor at:

The backdoor periodically polled GitHub for signed command-and-control messages containing the string:firedalazer

When a valid signed instruction is identified, the malware retrieves and executes remote Python code from attacker-controlled infrastructure, effectively providing the operators with ongoing remote execution capabilities on compromised systems. To date,this command and control infrastructure has not been observed active.

Investigation into additional impacted packages and infrastructure remains ongoing.

Wiz Research assesses with moderate confidence that this activity is associated with the threat actor known as “TeamPCP”. The attribution is based on infrastructure overlaps, malware functionality, operational patterns, and tradecraft observed throughout the investigation.

While the investigation remains ongoing, the campaign demonstrates coordination and operational maturity consistent with previous activity linked to the group.

~/.local/share/kitty/cat.py

niagA oG eW ereH :duluH-iahS

firedalazer

macOS ~/Library/LaunchAgents/com.user.kitty-monitor.plist Linux ~/.config/systemd/user/kitty-monitor.service

Organizations should immediately investigate developer workstations, CI/CD environments, and repositories for signs of compromise. Teams should audit systems for the affected packages, GitHub Actions, and VSCode extensions, while also reviewing GitHub activity for unauthorized repositories, newly created access tokens, or suspicious workflow executions.

Because the malware targets developer credentials and secrets, organizations should assume potential exposure of GitHub tokens, SSH keys, cloud credentials, and CI/CD secrets, and rotate them accordingly.

Security teams should also hunt for persistence mechanisms and unusual outbound GitHub communication, including the presence of the following file:~/.local/share/kitty/cat.py/

Finally, organizations should strengthen software supply chain defenses by implementing dependency allowlisting, SBOM generation, package verification, and improved monitoring of developer and build environments.

Wiz customers can usethe pre-built queries and advisoryin theWiz Threat Intel Centerto search for relevant instances in their environment. Wiz Research will continue to update that advisory as the situation develops.

nrwl impact report

Original GitHub Thread

StepSecurity Blog on VSCode

StepSecurity Blog on GitHub Actions

Socket Blog on Overall Compromises

Eliminate cryptographic blind spots and neutralize legacy debt with an integrated cryptographic asset inventory. Identify risks across code, cloud, and runtime, using the Wiz Security Graph to prioritize migration and protect against "Harvest Now, Decrypt Later" attacks.

See proven, exploitable risk in the context of your full cloud environment

A new page-cache corruption vulnerability in the Dirty Frag family enables unprivileged local attackers to achieve root

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings