OAK — OnChain Attack Knowledge

Threat actor · OAK-G20

OAK-G20 — TeamPCP (cross-ecosystem supply-chain worm operator)

Aliases
TeamPCP (the group's self-chosen name, in widest public use), UNC6780 (Google Threat Intelligence Group tracker), DeadCatx3, PCPcat, ShellForce. The group's campaigns are named separately from the group and are frequently confused with it in reporting: Shai-Hulud (the September and November 2025 waves) and Mini Shai-Hulud (the April and May 2026 waves) are campaign names, taken from the sandworms of Frank Herbert's Dune, and the operational infrastructure carries the theme throughout — branch markers observed include fremen, sandworm, harkonnen, atreides, melange, and tleilaxu.
First observed in crypto
September 2025 (first Shai-Hulud wave against npm). Crypto exposure is indirect by design — see Targeting profile.
Attribution status
inferred-strong at the cluster level, self-claimed per campaign. No individual has been named, indicted, or arrested, and no state alignment is claimed by any vendor. What supports the cluster identity is unusually strong for an unindicted group: the operators claim their campaigns publicly (credential dumps published to GitHub repositories captioned "A Mini Shai-Hulud has Appeared", forum posts claiming the GitHub and Nx breaches), the campaigns share a consistent naming-and-infrastructure theme, and the cluster is tracked independently by Google Threat Intelligence Group (UNC6780), JFrog, Snyk, Orca, Tenable, StepSecurity and Cloud Security Alliance. OAK records the cluster as inferred-strong rather than confirmed because self-claim is not evidence of identity — it establishes that one operator group claims a set of campaigns, not who they are.
Active
yes as of 2026-09. The most recent documented wave is 2026-05-11 (TanStack). On 2026-05-12 the operators published the worm's source code to GitHub under an MIT licence with the message "Shai-Hulud: Open Sourcing The Carnage", including guidance on swapping encryption keys and infrastructure, and announced a $1,000 contest on BreachForums for the largest supply-chain attack built from it. That release means the tooling is now separable from the operator, and subsequent Shai-Hulud-shaped incidents cannot be attributed to G20 on payload resemblance alone.

Description

OAK-G20 is the operator cluster behind the first documented self-propagating supply-chain worm that crosses package-ecosystem boundaries without human involvement. The payload steals developer and cloud credentials during package installation, and then uses the stolen publishing tokens to poison further packages — so each compromised maintainer becomes the next wave's launch point. Propagation has been observed across npm, PyPI, GitHub Actions, VS Code extensions, Docker Hub and Kubernetes, which is what separates this cluster from the long tail of single-registry package-poisoning operators the corpus otherwise sees.

The group is distinct from OAK's other Groups along the axis that matters most for defenders: it does not steal cryptocurrency, it steals the ability to ship code. OAK-G01 (Lazarus) and OAK-G08 (BlueNoroff) monetise intrusions directly through on-chain theft; OAK-G02 (Drainer-as-a-Service) sells wallet-drain tooling to affiliates; OAK-G05/G10/G11 are ransomware operating brands that monetise through extortion payments. G20 monetises by harvesting credentials at ecosystem scale and selling or publishing them, and the crypto-relevant loss happens downstream, in whatever a buyer or a later operator does with an npm publish token belonging to a Web3 SDK, a cloud secret belonging to an exchange, or a signing credential belonging to a wallet vendor. The group's own campaigns have also harvested wallet material directly where it was present on developer endpoints.

The technical signature is CI/CD-native rather than endpoint-native. The TanStack wave chained three GitHub Actions weaknesses: a pwn request (a fork pull request reaching a pull_request_target workflow with the base repository's security context), cache poisoning (a corrupted pnpm-store entry planted by the first stage and later consumed by the legitimate release workflow), and OIDC token extraction read directly out of runner memory via /proc/<pid>/mem, which yielded direct npm publishing rights. The malicious versions that followed carried valid SLSA Build Level 3 provenance attestations — they were built by the project's real pipeline, so provenance verification affirmed them. That is the cluster's most important lesson and it generalises well beyond this operator: provenance attests to the pipeline, and the pipeline was the thing compromised.

Targeting profile

The victim set is developer infrastructure, selected for downstream reach rather than for the value held by the immediate victim:

  • Package registries and their maintainers — npm and PyPI publishing credentials are the group's primary objective and its propagation mechanism. Named compromised projects include TanStack (42 npm packages, 84 malicious versions), Mistral AI, Guardrails AI, UiPath and OpenSearch; the May 2026 wave reached 170+ packages and 400+ malicious versions across npm and PyPI within roughly five hours, against packages downloaded on the order of 200M times per week.
  • Developer IDE extensions — the Nx Console VS Code extension (2.2M+ installs), trojanised on 2026-05-18 and live for about 11 minutes, which was enough for auto-update to reach a large installed base.
  • CI/CD substrate itself — GitHub Actions workflows, runner memory, OIDC tokens, cloud metadata endpoints, and CI secret stores. Harvest targets documented across waves include GitHub tokens, npm tokens, AWS IAM credentials, HashiCorp Vault secrets, Kubernetes and 1Password material, and — first observed in the Nx wave — AI-coding-assistant configuration (~/.claude/settings.json).
  • Downstream enterprises reached through the above — approximately 3,800 private repositories exfiltrated from affected GitHub organisations; GitHub's CISO named Nx Console as the vector, and Grafana Labs' breach was traced to the same chain.
  • Crypto-industry exposure is second-order but direct in effect — Web3 SDK publish tokens, exchange and wallet-vendor cloud secrets, and key material present on developer endpoints. OAK does not record a specific on-chain theft attributed to G20; it records the cluster because this is the population from which the next wallet-draining package compromise will be drawn, and because the corpus already documents that pattern landing (T11.009).

Observed Techniques

  • OAK-T15.002 (Supply-Chain / Vendor-Pipeline Compromise) — the cluster's defining Technique. Every documented wave is a trusted publishing pipeline made to ship attacker code under its own legitimate identity and, in the TanStack case, its own valid provenance attestation.
  • OAK-T15.004 (Operator-Side Credential Compromise) — both the entry vector and the product. A credential stolen in one wave is the publishing right used in the next; the Nx Console compromise was executed with a developer's GitHub credentials leaked by the earlier TanStack compromise.
  • OAK-T11.009 (Trader-Tooling Supply-Chain / Environment-Key Compromise) — the crypto-relevant end state, where harvested npm tokens, cloud secrets and environment key material become the input to key exfiltration from Web3 developer and trading tooling.
  • OAK-T4.013 (Endpoint Infostealer / Wallet-Credential Exfiltration) — where the worm executed on developer endpoints holding wallet material, the harvest primitive is the same one OAK tracks under T4.013; recorded here as an observed capability of the payload rather than as an attributed on-chain theft.

Observed Examples

Worked examples in examples/:

  • examples/2026-05-nx-console-vscode-extension-supply-chain-compromise.md — Nx Console VS Code extension trojanised release (nrwl.angular-console v18.95.0), 2026-05-18. Multi-stage credential stealer fetched from a dangling orphan commit inside the official nrwl/nx repository; exfiltration over HTTPS, the GitHub API and DNS tunnelling; ~3,800 private repositories taken downstream. Claimed by the group and corroborated by Nx's own postmortem, CISA, StepSecurity and OX Security.

The wider campaign record anchoring the cluster (narrative — not separately documented as worked examples, because the on-chain loss surface is downstream and unquantified):

  • Shai-Hulud waves (September and November 2025). First npm campaigns under the Shai-Hulud name, establishing the self-propagating credential-harvest pattern.
  • Mini Shai-Hulud (April 2026, then 2026-05-11 TanStack wave). 42 TanStack npm packages, 84 malicious versions with valid SLSA L3 provenance, propagating to 170+ packages and 400+ versions across npm and PyPI within about five hours; associated CVE-2026-45321.
  • Source-code release (2026-05-12). Worm published on GitHub under MIT licence with operational guidance and a $1,000 BreachForums contest for the largest attack built from it. This is the fact most likely to matter later: it converts a tracked operator's tooling into a commodity, and it breaks payload-resemblance attribution for everything that follows.

Citations

Discussion

G20 is the first OAK Group whose product is access rather than money, and the corpus should expect that shape to recur. The cluster's own campaigns produce no attributable on-chain loss; what they produce is a supply of publishing credentials and cloud secrets, some fraction of which belongs to firms that hold keys. OAK tracks it for the same reason it tracks OAK-G02 (Drainer-as-a-Service): the identity that matters to defenders is the one that supplies capability to other operators, and that identity persists across campaigns while individual incidents do not.

Two properties make this cluster hard to defend against with the controls currently recommended across the corpus. First, provenance and signing did not help, because the pipeline was the compromise — the TanStack versions carried valid SLSA Build Level 3 attestations, which is exactly the assurance the ecosystem has been asked to adopt, and it was truthful and useless simultaneously. Any mitigation in OAK that reads "verify the publisher attestation" needs the qualifier that attestation binds a build to a pipeline, not a pipeline to an intent. Second, the propagation is autonomous, so the response window is set by worm speed rather than by operator working hours: 170+ packages in roughly five hours, and an 11-minute exposure window on Nx Console that auto-update turned into a large installed base.

The 2026-05-12 source release is the item to watch. Once the worm is MIT-licensed on GitHub with a prize attached for the largest campaign built from it, subsequent incidents with Shai-Hulud-shaped payloads are evidence of the tooling, not of this operator. Contributors documenting a future package-ecosystem worm should attribute to G20 only on the group's own claim, on infrastructure overlap, or on a vendor's independent cluster tracking — never on payload similarity alone. That caveat is the reason this card exists now rather than after the next wave: the attribution ground is about to get worse, and the cluster's pre-release record is the clean reference.