IC Technology & Surveillance — 2026-05-17
TeamPCP Releases Source Code of Shai-Hulud Worm, Escalating Open-Source Offensive Tool Proliferation
BLUFOpen-sourcing a production-grade supply chain toolkit alongside a download-count bounty likely triggers at least one in-the-wild campaign within 90 days, shifting defenders onto behavioral monitoring as lower-skilled actors gain capability.
The source code was published to GitHub on May 12 under an MIT License with the message 'Open Sourcing The Carnage'; GitHub removed the repositories but 39+ forks had already proliferated before takedown. The 'challenge' is a $1,000 Monero prize contest co-hosted by BreachForums, scoring participants by download count of compromised open-source packages, explicitly rewarding attacks on the most widely used libraries. Static analysis by Datadog Security Labs characterized the framework as a production-grade modular TypeScript/Bun toolkit containing credential harvesters, supply chain poisoners, encrypted exfiltrators, and a deadman-switch process that continuously checks whether stolen GitHub tokens remain valid.
Analysis
Ox Security has already observed threat actors adapting the released code for active attacks. At least one confirmed in-the-wild campaign islikely within the next 90 days, per Datadog's direct source-code analysis as the primary anchor, with no independent replication beyond preliminary Ox reporting. The BreachForums download-count scoring compresses time-to-first-attack for lower-skilled actors who previously lacked supply chain capability. Non-reproducible compiled binaries defeat YARA and hash-based detection, pushing defenders onto behavioral monitoring precisely as campaign volume surges. The open-sourcing may primarily serve as a plausible deniability operation, enabling TeamPCP to attribute subsequent attacks to copycats, which makes immediate CI/CD audits and credential rotation more pressing than quarterly review cycles.
Ox Security has already observed threat actors adapting the released code for active attacks. At least one confirmed in-the-wild campaign is