The ongoing software supply chain campaign targeting the open source ecosystem reemerged on May 19th, affecting NPM packages, GitHub Actions, and a VSCode extension.  The distributed malware was designed to harvest credentials, exfiltrate sensitive data, and establish persistent access on infected systems. 

As the activity unfolded publicly, Wiz Research independently observed related malicious activity in real time across developer and CI/CD environments.

Based on infrastructure analysis, malware behavior, and operational overlaps identified during the investigation, Wiz attributes this activity to the threat actor known as “TeamPCP”.

What Happened

Researchers have dissected a coordinated software supply chain attack campaign affecting multiple components within the developer ecosystem, including npm packages (prominently those in the @antv namespace), GitHub Actions (e.g actions-cool/issues-helper) and a VSCode extension (nrwl.angular-console v18.95.0). 

Upon installation of the npm packages, the malicious code initiated a multi-stage infection chain designed to retrieve additional payloads from GitHub-hosted infrastructure. In several cases, the payloads were stored in orphaned GitHub commits, likely as an attempt to evade detection and maintain operational resilience. The malware then used bun to install and execute secondary payloads responsible for credential theft and persistence.

The malware collected a wide range of sensitive artifacts from infected systems, including GitHub tokens, SSH keys, cloud credentials, browser-stored secrets, and other developer-related authentication material. Exfiltration occurred through attacker-created public GitHub repositories generated from the victim environment. Investigators observed repositories created with the description:

niagA oG eW ereH :duluH-iahS

In addition to credential theft, the malware established persistence by installing a Python-based backdoor at:

~/.local/share/kitty/cat.py

The backdoor periodically polled GitHub for signed command-and-control messages containing the string: firedalazer

When a valid signed instruction is identified, the malware retrieves and executes remote Python code from attacker-controlled infrastructure, effectively providing the operators with ongoing remote execution capabilities on compromised systems. To date, this command and control infrastructure has not been observed active. 

Investigation into additional impacted packages and infrastructure remains ongoing.

Attribution

Wiz Research assesses with moderate confidence that this activity is associated with the threat actor known as “TeamPCP”. The attribution is based on infrastructure overlaps, malware functionality, operational patterns, and tradecraft observed throughout the investigation.

While the investigation remains ongoing, the campaign demonstrates coordination and operational maturity consistent with previous activity linked to the group.

Indicators of Compromise

File Paths

~/.local/share/kitty/cat.py

GitHub Repository Description

niagA oG eW ereH :duluH-iahS

Command-and-Control Trigger

firedalazer

Network Indicators

Host Indicators

What Steps Should Security Teams Take

• Organizations should immediately investigate developer workstations, CI/CD environments, and repositories for signs of compromise. Teams should audit systems for the affected packages, GitHub Actions, and VSCode extensions, while also reviewing GitHub activity for unauthorized repositories, newly created access tokens, or suspicious workflow executions.

• Because the malware targets developer credentials and secrets, organizations should assume potential exposure of GitHub tokens, SSH keys, cloud credentials, and CI/CD secrets, and rotate them accordingly.

• Security teams should also hunt for persistence mechanisms and unusual outbound GitHub communication, including the presence of the following file: ~/.local/share/kitty/cat.py/

• Finally, organizations should strengthen software supply chain defenses by implementing dependency allowlisting, SBOM generation, package verification, and improved monitoring of developer and build environments.

How Wiz Can Help

Wiz customers can use the pre-built queries and advisory in the Wiz Threat Intel Center to search for relevant instances in their environment. Wiz Research will continue to update that advisory as the situation develops. 

References

• nrwl impact report

• Original GitHub Thread

• StepSecurity Blog on VSCode

• StepSecurity Blog on GitHub Actions

• Socket Blog on Overall Compromises

Appendix

Affected GitHub Actions

Compromised VSCode Extension

Malicious NPM Packages