> ## Content Index
> Fetch the complete content index at: https://adjacent.media/llms.txt
> Use this file to discover other available public pages before exploring further.

# Hacker group exploited open source trust to poison 1,000+ packages
- URL: https://adjacent.media/signals/hacker-group-exploited-open-source-trust-to-poison-1-000-packages/
- Published: 2026-06-19T16:10:26.000Z
- Updated: 2026-06-19T16:10:26.000Z
- Description: TeamPCP’s attack exposes a structural vulnerability in how developers distribute code. By compromising packages at the source rather than targeting individual users, they achieved scale impossible through traditional malware vectors.
- Author: Jonathan Greene
- Tags: #signal, theme-connected, infrastructure security, supply chain attack, open source vulnerabilities

Source: [Cyberscoop](https://cyberscoop.com/teampcp-breaks-open-source-software-trust-model/?ref=adjacent.media)

TeamPCP's attack exposes a structural vulnerability in how developers distribute code. By compromising packages at the source rather than targeting individual users, they achieved scale impossible through traditional malware vectors. The attack shows that code repositories—long assumed to be trustworthy intermediaries—are now a viable attack surface. Enterprises will need to shift from verification-by-incident to verification-by-default in their dependency management.