The TeamPCP arrests, from the inside

Key Topics: 

• How the cascade actually worked. Wave by wave, from a service account compromise to 76 of 77 poisoned version tags to malicious releases on PyPI, and why the credential rather than the CVE was the payload.
• Why an incomplete rotation was the whole story. A February 2026 breach was patched but not fully rotated. That single gap is what made March possible, and it is the most common version of this failure.
• What “still running” looks like in practice. The compromises that landed after the March reporting cycle closed, and why patching a package does not end exposure when access chains through stolen tokens.
• A concrete verification checklist. The specific package versions, action tags and exposure windows to check, and what to treat as compromised regardless of whether the tool was invoked.
• How the trust boundary should be redrawn. A security tool sits inside the trust boundary of every pipeline it runs in. Very few organizations model it that way, and this is the case study for changing that.