TeamPCP Expands From Next.js and npm Compromises to Proxy and Ransomware Operations

Researchers linked TeamPCP to multiple interconnected intrusion campaigns spanning web application exploitation, software supply-chain abuse, and infrastructure hijacking. Reporting on the Operation PCPcat and React2Shell activity said attackers exploited vulnerable Next.js deployments and compromised roughly 59,000 servers, using them to steal credentials and build follow-on access. Separate investigations into the CanisterWorm campaign found dozens of malicious npm packages carrying hidden postinstall scripts that stole npm tokens from .npmrc, /etc/npmrc, and environment variables, then republished trojanized updates through victims’ own publisher accounts. The malware also established Linux persistence with a masqueraded user-level systemd service named pgmon and fetched later-stage payloads through Internet Computer canister infrastructure, complicating takedown efforts.

Additional reporting tied the broader operation to compromised CI/CD ecosystems, residential proxy building, and ransomware monetization. An investigation into the Xygeni GitHub Action compromise found the same custom ShadowLink backdoor protocol used in malware that exploited TP-Link and ASUS routers, including abuse of CVE-2024-21833 to install microsocks and maintain SOCKS5 proxy persistence via cron, rc.local, and NVRAM changes; researchers said this strongly links the router campaign to the Xygeni intrusion, while overlap with TeamPCP remains partly circumstantial. By late March, defenders reported TeamPCP had slowed new package compromises and shifted toward monetization through harvested credentials and dual ransomware tracks, including its own CipherForce operation and activity aligned with the Vect ransomware ecosystem; related fallout included ownCloud disclosing build infrastructure exposure through CVE-2026-33634 associated with the Trivy compromise.