#teampcp — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #teampcp, aggregated by home.social.
-
🕵🏻♂️ [InfoSec MASHUP] 21/2026 - The Supply Chain Didn't Break. It Was Walked.
This week's issue reads like a case study in cascade failure. A malicious VS Code extension on one #GitHub employee's device leads to 3,800 internal repositories exfiltrated — by #TeamPCP, the same group that poisoned 170 npm and #PyPI packages last week. #Grafana gets breached via a token nobody rotated after the TanStack attack, itself a TeamPCP operation. A GitHub Action used by thousands of projects gets compromised and starts exfiltrating CI/CD credentials. And somewhere in a public GitHub spreadsheet, CISA contractor credentials — including #AWS GovCloud keys — sat waiting to be found.
These aren't four separate incidents. They're one incident with four manifestations. The supply chain isn't a vector anymore; it's the terrain. Developer tooling, CI/CD pipelines, third-party actions, tokens issued and forgotten — all of it is now actively mapped and exploited with a persistence that makes the traditional "patch and move on" response look quaint. The Verizon DBIR dropped this week noting that third-party compromise is surging. The week's news was already illustrating the point before the report landed.
→ Week #21/2026 also covers: fast16 predated #Stuxnet and corrupted nuclear simulations quietly, #Pwn2Own Berlin paid $1.3M for 47 bugs, and #Bluesky got hijacked for Russian propaganda.
Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-21-2026-the-supply-chain-didn-t-break-it-was-walked
If you find it useful, subscribe to get it in your inbox every weekend 📨 #infosecMASHUP #cybersecurity #infosec #threatintel #AI
-
🕵🏻♂️ [InfoSec MASHUP] 21/2026 - The Supply Chain Didn't Break. It Was Walked.
This week's issue reads like a case study in cascade failure. A malicious VS Code extension on one #GitHub employee's device leads to 3,800 internal repositories exfiltrated — by #TeamPCP, the same group that poisoned 170 npm and #PyPI packages last week. #Grafana gets breached via a token nobody rotated after the TanStack attack, itself a TeamPCP operation. A GitHub Action used by thousands of projects gets compromised and starts exfiltrating CI/CD credentials. And somewhere in a public GitHub spreadsheet, CISA contractor credentials — including #AWS GovCloud keys — sat waiting to be found.
These aren't four separate incidents. They're one incident with four manifestations. The supply chain isn't a vector anymore; it's the terrain. Developer tooling, CI/CD pipelines, third-party actions, tokens issued and forgotten — all of it is now actively mapped and exploited with a persistence that makes the traditional "patch and move on" response look quaint. The Verizon DBIR dropped this week noting that third-party compromise is surging. The week's news was already illustrating the point before the report landed.
→ Week #21/2026 also covers: fast16 predated #Stuxnet and corrupted nuclear simulations quietly, #Pwn2Own Berlin paid $1.3M for 47 bugs, and #Bluesky got hijacked for Russian propaganda.
Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-21-2026-the-supply-chain-didn-t-break-it-was-walked
If you find it useful, subscribe to get it in your inbox every weekend 📨 #infosecMASHUP #cybersecurity #infosec #threatintel #AI
-
🕵🏻♂️ [InfoSec MASHUP] 21/2026 - The Supply Chain Didn't Break. It Was Walked.
This week's issue reads like a case study in cascade failure. A malicious VS Code extension on one #GitHub employee's device leads to 3,800 internal repositories exfiltrated — by #TeamPCP, the same group that poisoned 170 npm and #PyPI packages last week. #Grafana gets breached via a token nobody rotated after the TanStack attack, itself a TeamPCP operation. A GitHub Action used by thousands of projects gets compromised and starts exfiltrating CI/CD credentials. And somewhere in a public GitHub spreadsheet, CISA contractor credentials — including #AWS GovCloud keys — sat waiting to be found.
These aren't four separate incidents. They're one incident with four manifestations. The supply chain isn't a vector anymore; it's the terrain. Developer tooling, CI/CD pipelines, third-party actions, tokens issued and forgotten — all of it is now actively mapped and exploited with a persistence that makes the traditional "patch and move on" response look quaint. The Verizon DBIR dropped this week noting that third-party compromise is surging. The week's news was already illustrating the point before the report landed.
→ Week #21/2026 also covers: fast16 predated #Stuxnet and corrupted nuclear simulations quietly, #Pwn2Own Berlin paid $1.3M for 47 bugs, and #Bluesky got hijacked for Russian propaganda.
Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-21-2026-the-supply-chain-didn-t-break-it-was-walked
If you find it useful, subscribe to get it in your inbox every weekend 📨 #infosecMASHUP #cybersecurity #infosec #threatintel #AI
-
🕵🏻♂️ [InfoSec MASHUP] 21/2026 - The Supply Chain Didn't Break. It Was Walked.
This week's issue reads like a case study in cascade failure. A malicious VS Code extension on one #GitHub employee's device leads to 3,800 internal repositories exfiltrated — by #TeamPCP, the same group that poisoned 170 npm and #PyPI packages last week. #Grafana gets breached via a token nobody rotated after the TanStack attack, itself a TeamPCP operation. A GitHub Action used by thousands of projects gets compromised and starts exfiltrating CI/CD credentials. And somewhere in a public GitHub spreadsheet, CISA contractor credentials — including #AWS GovCloud keys — sat waiting to be found.
These aren't four separate incidents. They're one incident with four manifestations. The supply chain isn't a vector anymore; it's the terrain. Developer tooling, CI/CD pipelines, third-party actions, tokens issued and forgotten — all of it is now actively mapped and exploited with a persistence that makes the traditional "patch and move on" response look quaint. The Verizon DBIR dropped this week noting that third-party compromise is surging. The week's news was already illustrating the point before the report landed.
→ Week #21/2026 also covers: fast16 predated #Stuxnet and corrupted nuclear simulations quietly, #Pwn2Own Berlin paid $1.3M for 47 bugs, and #Bluesky got hijacked for Russian propaganda.
Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-21-2026-the-supply-chain-didn-t-break-it-was-walked
If you find it useful, subscribe to get it in your inbox every weekend 📨 #infosecMASHUP #cybersecurity #infosec #threatintel #AI
-
🕵🏻♂️ [InfoSec MASHUP] 21/2026 - The Supply Chain Didn't Break. It Was Walked.
This week's issue reads like a case study in cascade failure. A malicious VS Code extension on one #GitHub employee's device leads to 3,800 internal repositories exfiltrated — by #TeamPCP, the same group that poisoned 170 npm and #PyPI packages last week. #Grafana gets breached via a token nobody rotated after the TanStack attack, itself a TeamPCP operation. A GitHub Action used by thousands of projects gets compromised and starts exfiltrating CI/CD credentials. And somewhere in a public GitHub spreadsheet, CISA contractor credentials — including #AWS GovCloud keys — sat waiting to be found.
These aren't four separate incidents. They're one incident with four manifestations. The supply chain isn't a vector anymore; it's the terrain. Developer tooling, CI/CD pipelines, third-party actions, tokens issued and forgotten — all of it is now actively mapped and exploited with a persistence that makes the traditional "patch and move on" response look quaint. The Verizon DBIR dropped this week noting that third-party compromise is surging. The week's news was already illustrating the point before the report landed.
→ Week #21/2026 also covers: fast16 predated #Stuxnet and corrupted nuclear simulations quietly, #Pwn2Own Berlin paid $1.3M for 47 bugs, and #Bluesky got hijacked for Russian propaganda.
Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-21-2026-the-supply-chain-didn-t-break-it-was-walked
If you find it useful, subscribe to get it in your inbox every weekend 📨 #infosecMASHUP #cybersecurity #infosec #threatintel #AI
-
Megalodon: 5.561 repository GitHub compromessi in sei ore con workflow CI/CD malevoli
In sei ore il 18 maggio 2026, la campagna automatizzata Megalodon ha iniettato 5.718 commit malevoli in 5.561 repository GitHub, esfiltrandone credenziali cloud, chiavi SSH e segreti CI/CD verso un C2 esterno. L'operazione, collegata al gruppo TeamPCP, rappresenta uno degli attacchi alla supply chain dello sviluppo software più rapidi mai documentati e ha spinto npm a invalidare migliaia di token di accesso con bypass 2FA. -
Megalodon: 5.561 repository GitHub compromessi in sei ore con workflow CI/CD malevoli
In sei ore il 18 maggio 2026, la campagna automatizzata Megalodon ha iniettato 5.718 commit malevoli in 5.561 repository GitHub, esfiltrandone credenziali cloud, chiavi SSH e segreti CI/CD verso un C2 esterno. L'operazione, collegata al gruppo TeamPCP, rappresenta uno degli attacchi alla supply chain dello sviluppo software più rapidi mai documentati e ha spinto npm a invalidare migliaia di token di accesso con bypass 2FA. -
Megalodon: 5.561 repository GitHub compromessi in sei ore con workflow CI/CD malevoli
In sei ore il 18 maggio 2026, la campagna automatizzata Megalodon ha iniettato 5.718 commit malevoli in 5.561 repository GitHub, esfiltrandone credenziali cloud, chiavi SSH e segreti CI/CD verso un C2 esterno. L'operazione, collegata al gruppo TeamPCP, rappresenta uno degli attacchi alla supply chain dello sviluppo software più rapidi mai documentati e ha spinto npm a invalidare migliaia di token di accesso con bypass 2FA. -
Megalodon: 5.561 repository GitHub compromessi in sei ore con workflow CI/CD malevoli
In sei ore il 18 maggio 2026, la campagna automatizzata Megalodon ha iniettato 5.718 commit malevoli in 5.561 repository GitHub, esfiltrandone credenziali cloud, chiavi SSH e segreti CI/CD verso un C2 esterno. L'operazione, collegata al gruppo TeamPCP, rappresenta uno degli attacchi alla supply chain dello sviluppo software più rapidi mai documentati e ha spinto npm a invalidare migliaia di token di accesso con bypass 2FA. -
Megalodon: 5.561 repository GitHub compromessi in sei ore con workflow CI/CD malevoli
In sei ore il 18 maggio 2026, la campagna automatizzata Megalodon ha iniettato 5.718 commit malevoli in 5.561 repository GitHub, esfiltrandone credenziali cloud, chiavi SSH e segreti CI/CD verso un C2 esterno. L'operazione, collegata al gruppo TeamPCP, rappresenta uno degli attacchi alla supply chain dello sviluppo software più rapidi mai documentati e ha spinto npm a invalidare migliaia di token di accesso con bypass 2FA. -
#Opensource als Einfallstor: #Supplychain-Angriffe sind kein neues Phänomen, mit der wachsenden Bedeutung von Open Source in der Wirtschaft aber passen auch #Cyberkriminelle ihre Vorgehensweise an.
So hat die #Cybercrime-Gruppe #TeamPCP den vollständigen Quellcode ihrer Schadsoftware Shai-Hulud öffentlich zugänglich gemacht und dazu aufgerufen, auf dieser Basis weitere Klone zu entwickeln, mit denen gezielt Angriffe auf Software-#Lieferketten durchgeführt werden sollen:
https://www.wired.com/story/teampcp-software-supply-chain-attack-spree-github/
-
#Opensource als Einfallstor: #Supplychain-Angriffe sind kein neues Phänomen, mit der wachsenden Bedeutung von Open Source in der Wirtschaft aber passen auch #Cyberkriminelle ihre Vorgehensweise an.
So hat die #Cybercrime-Gruppe #TeamPCP den vollständigen Quellcode ihrer Schadsoftware Shai-Hulud öffentlich zugänglich gemacht und dazu aufgerufen, auf dieser Basis weitere Klone zu entwickeln, mit denen gezielt Angriffe auf Software-#Lieferketten durchgeführt werden sollen:
https://www.wired.com/story/teampcp-software-supply-chain-attack-spree-github/
-
#Opensource als Einfallstor: #Supplychain-Angriffe sind kein neues Phänomen, mit der wachsenden Bedeutung von Open Source in der Wirtschaft aber passen auch #Cyberkriminelle ihre Vorgehensweise an.
So hat die #Cybercrime-Gruppe #TeamPCP den vollständigen Quellcode ihrer Schadsoftware Shai-Hulud öffentlich zugänglich gemacht und dazu aufgerufen, auf dieser Basis weitere Klone zu entwickeln, mit denen gezielt Angriffe auf Software-#Lieferketten durchgeführt werden sollen:
https://www.wired.com/story/teampcp-software-supply-chain-attack-spree-github/
-
#Opensource als Einfallstor: #Supplychain-Angriffe sind kein neues Phänomen, mit der wachsenden Bedeutung von Open Source in der Wirtschaft aber passen auch #Cyberkriminelle ihre Vorgehensweise an.
So hat die #Cybercrime-Gruppe #TeamPCP den vollständigen Quellcode ihrer Schadsoftware Shai-Hulud öffentlich zugänglich gemacht und dazu aufgerufen, auf dieser Basis weitere Klone zu entwickeln, mit denen gezielt Angriffe auf Software-#Lieferketten durchgeführt werden sollen:
https://www.wired.com/story/teampcp-software-supply-chain-attack-spree-github/
-
#Opensource als Einfallstor: #Supplychain-Angriffe sind kein neues Phänomen, mit der wachsenden Bedeutung von Open Source in der Wirtschaft aber passen auch #Cyberkriminelle ihre Vorgehensweise an.
So hat die #Cybercrime-Gruppe #TeamPCP den vollständigen Quellcode ihrer Schadsoftware Shai-Hulud öffentlich zugänglich gemacht und dazu aufgerufen, auf dieser Basis weitere Klone zu entwickeln, mit denen gezielt Angriffe auf Software-#Lieferketten durchgeführt werden sollen:
https://www.wired.com/story/teampcp-software-supply-chain-attack-spree-github/
-
A #Hacker Group Is Poisoning #OpenSource Code at an Unprecedented Scale
#GitHub is just the latest victim of #TeamPCP , a gang that has carried out a spree of software #supplyChain attacks that has impacted hundreds of organizations.
#securityhttps://www.wired.com/story/teampcp-software-supply-chain-attack-spree-github/
-
asking for at least $50,000 for the stolen data.
-
#Grafana says stolen #GitHub token let hackers steal codebase
#privacy #cybersecurity #DataBreach #analytics #TeamPCP #npm #ShaiHulud
-
#Grafana says stolen #GitHub token let hackers steal codebase
#privacy #cybersecurity #DataBreach #analytics #TeamPCP #npm #ShaiHulud
-
#Grafana says stolen #GitHub token let hackers steal codebase
#privacy #cybersecurity #DataBreach #analytics #TeamPCP #npm #ShaiHulud
-
#Grafana says stolen #GitHub token let hackers steal codebase
#privacy #cybersecurity #DataBreach #analytics #TeamPCP #npm #ShaiHulud
-
#Grafana says stolen #GitHub token let hackers steal codebase
#privacy #cybersecurity #DataBreach #analytics #TeamPCP #npm #ShaiHulud
-
3/3 This is the supply chain attack pattern again -- trust the tooling, lose the kingdom. We covered the Anthropic npm leak last week. Same thread. The extension marketplace is the new npm.
If your source control, your IDE, and your CI/CD pipeline all report to Redmond -- that's not a stack. That's a single point of failure with good branding.
🔗 haunted.lighthouse.co.im
#GitHub #SupplyChain #DigitalSovereignty #CyberSecurity #VSCode #TeamPCP -
GitHub Probes Breach Claim by TeamPCP Hackers
GitHub is investigating a security breach claim by hackers TeamPCP, who allegedly stole around 4,000 of the platform's internal repositories and put the source code up for sale for a hefty $50,000. The company has already sprung into action, detecting and containing the breach and taking steps to mitigate the risk.
-
Mini Shai-Hulud: TeamPCP compromette 160+ pacchetti npm e PyPI in un supply chain attack che ha colpito TanStack, Mistral AI e OpenAI
Tra il 11 e il 14 maggio 2026, il gruppo TeamPCP ha compromesso oltre 160 pacchetti npm e 2 PyPI in un supply chain attack di nuova generazione soprannominato 'Mini Shai-Hulud'. Attraverso l'avvelenamento della cache GitHub Actions, il malware si è auto-propagato nei namespace di TanStack, Mistral AI e UiPath. Il pacchetto node-ipc (822K download settimanali) è stato compromesso separatamente con un payload che rubava 90+ categorie di credenziali. Tra le vittime: due dipendenti di OpenAI. -
Mini Shai-Hulud: TeamPCP compromette 160+ pacchetti npm e PyPI in un supply chain attack che ha colpito TanStack, Mistral AI e OpenAI
Tra il 11 e il 14 maggio 2026, il gruppo TeamPCP ha compromesso oltre 160 pacchetti npm e 2 PyPI in un supply chain attack di nuova generazione soprannominato 'Mini Shai-Hulud'. Attraverso l'avvelenamento della cache GitHub Actions, il malware si è auto-propagato nei namespace di TanStack, Mistral AI e UiPath. Il pacchetto node-ipc (822K download settimanali) è stato compromesso separatamente con un payload che rubava 90+ categorie di credenziali. Tra le vittime: due dipendenti di OpenAI. -
Mini Shai-Hulud: TeamPCP compromette 160+ pacchetti npm e PyPI in un supply chain attack che ha colpito TanStack, Mistral AI e OpenAI
Tra il 11 e il 14 maggio 2026, il gruppo TeamPCP ha compromesso oltre 160 pacchetti npm e 2 PyPI in un supply chain attack di nuova generazione soprannominato 'Mini Shai-Hulud'. Attraverso l'avvelenamento della cache GitHub Actions, il malware si è auto-propagato nei namespace di TanStack, Mistral AI e UiPath. Il pacchetto node-ipc (822K download settimanali) è stato compromesso separatamente con un payload che rubava 90+ categorie di credenziali. Tra le vittime: due dipendenti di OpenAI. -
Mini Shai-Hulud: TeamPCP compromette 160+ pacchetti npm e PyPI in un supply chain attack che ha colpito TanStack, Mistral AI e OpenAI
Tra il 11 e il 14 maggio 2026, il gruppo TeamPCP ha compromesso oltre 160 pacchetti npm e 2 PyPI in un supply chain attack di nuova generazione soprannominato 'Mini Shai-Hulud'. Attraverso l'avvelenamento della cache GitHub Actions, il malware si è auto-propagato nei namespace di TanStack, Mistral AI e UiPath. Il pacchetto node-ipc (822K download settimanali) è stato compromesso separatamente con un payload che rubava 90+ categorie di credenziali. Tra le vittime: due dipendenti di OpenAI. -
Mini Shai-Hulud: TeamPCP compromette 160+ pacchetti npm e PyPI in un supply chain attack che ha colpito TanStack, Mistral AI e OpenAI
Tra il 11 e il 14 maggio 2026, il gruppo TeamPCP ha compromesso oltre 160 pacchetti npm e 2 PyPI in un supply chain attack di nuova generazione soprannominato 'Mini Shai-Hulud'. Attraverso l'avvelenamento della cache GitHub Actions, il malware si è auto-propagato nei namespace di TanStack, Mistral AI e UiPath. Il pacchetto node-ipc (822K download settimanali) è stato compromesso separatamente con un payload che rubava 90+ categorie di credenziali. Tra le vittime: due dipendenti di OpenAI. -
🕵🏻♂️ [InfoSec MASHUP] 20/2026 - The Platform Is the Attack Surface.
The supply chain attack story this week isn't about a sketchy package lurking in a dark corner of npm. It's about #Anthropic Claude.ai shared chats being used to distribute Mac #malware, a fake Hugging Face repository impersonating OpenAI's Privacy Filter trending at #1 with 244,000 downloads, and JDownloader's own website serving swapped installers. The common thread isn't sophistication — it's borrowed credibility. Attackers have figured out that the detection model most users rely on, implicitly or otherwise, is "I've heard of this platform, therefore this thing on it is probably fine."
That assumption has always been fragile. What's changed is how systematically it's being exploited. A trending repo with a quarter-million downloads looks legitimate by every surface signal. A shared Claude.ai chat looks like a helpful resource. A download from the official project website looks like the official project. The trust isn't in the content — it's in the container. And the container is now the attack surface.
→ Week #20/2026 also covers: #ShinyHunters got paid, #TeamPCP hit 170 packages across npm and PyPI, and Cisco's SD-WAN zero-day count hit six for the year
Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-20-2026-the-platform-is-the-attack-surface
If you find it useful, subscribe to get it in your inbox every weekend 📨 #infosecMASHUP #cybersecurity #infosec #threatintel #AI
-
TeamPCP hackers target Mistral AI code repos for sale
Hackers from TeamPCP are demanding $25,000 for nearly 5 gigabytes of stolen Mistral AI code, threatening to leak it for free if they don't find a buyer within a week. The group claims to have snagged around 450 internal repositories, including sensitive source code used for training and model delivery.
#Teampcp #Ransomware #EmergingThreats #MistralAi #CodeRepositories
-
📢⚠️ A #TeamPCP-linked account claims to be selling alleged internal Mistral AI repositories days after the Mini Shai-Hulud supply chain attacks targeted npm and PyPI packages linked to the AI company.
Read: https://hackread.com/teampcp-mistral-ai-repositories-mini-shai-hulud-attack/
-
📢⚠️ A #TeamPCP-linked account claims to be selling alleged internal Mistral AI repositories days after the Mini Shai-Hulud supply chain attacks targeted npm and PyPI packages linked to the AI company.
Read: https://hackread.com/teampcp-mistral-ai-repositories-mini-shai-hulud-attack/
-
📢⚠️ A #TeamPCP-linked account claims to be selling alleged internal Mistral AI repositories days after the Mini Shai-Hulud supply chain attacks targeted npm and PyPI packages linked to the AI company.
Read: https://hackread.com/teampcp-mistral-ai-repositories-mini-shai-hulud-attack/
-
📢⚠️ A #TeamPCP-linked account claims to be selling alleged internal Mistral AI repositories days after the Mini Shai-Hulud supply chain attacks targeted npm and PyPI packages linked to the AI company.
Read: https://hackread.com/teampcp-mistral-ai-repositories-mini-shai-hulud-attack/
-
📢⚠️ A #TeamPCP-linked account claims to be selling alleged internal Mistral AI repositories days after the Mini Shai-Hulud supply chain attacks targeted npm and PyPI packages linked to the AI company.
Read: https://hackread.com/teampcp-mistral-ai-repositories-mini-shai-hulud-attack/
-
Research reveals that #TeamPCP hijacked OIDC tokens to poison hundreds of TanStack, Mistral AI, and UiPath packages with the self-propagating Mini Shai-Hulud worm.
Read: https://hackread.com/teampcp-mini-shai-hulud-worm-npm-pypi-packages/
-
Research reveals that #TeamPCP hijacked OIDC tokens to poison hundreds of TanStack, Mistral AI, and UiPath packages with the self-propagating Mini Shai-Hulud worm.
Read: https://hackread.com/teampcp-mini-shai-hulud-worm-npm-pypi-packages/
-
Research reveals that #TeamPCP hijacked OIDC tokens to poison hundreds of TanStack, Mistral AI, and UiPath packages with the self-propagating Mini Shai-Hulud worm.
Read: https://hackread.com/teampcp-mini-shai-hulud-worm-npm-pypi-packages/
-
Research reveals that #TeamPCP hijacked OIDC tokens to poison hundreds of TanStack, Mistral AI, and UiPath packages with the self-propagating Mini Shai-Hulud worm.
Read: https://hackread.com/teampcp-mini-shai-hulud-worm-npm-pypi-packages/
-
Research reveals that #TeamPCP hijacked OIDC tokens to poison hundreds of TanStack, Mistral AI, and UiPath packages with the self-propagating Mini Shai-Hulud worm.
Read: https://hackread.com/teampcp-mini-shai-hulud-worm-npm-pypi-packages/
-
More supply chain attacks incoming! Exciting! We are so fudged! Maybe, we''ll see.
From the Telegram channel of Breached/BreachForums:
Breached has teamed up with TeamPCP to host the first ever supply chain competition! Whoever is able to conduct the biggest supply chain operation using the now open source Shai Hulud worm will be congratulated and will receive a prize of $1000 USD in XMR from @diencracked. Make sure to read the rules posted in the announcement first.
-
More supply chain attacks incoming! Exciting! We are so fudged! Maybe, we''ll see.
From the Telegram channel of Breached/BreachForums:
Breached has teamed up with TeamPCP to host the first ever supply chain competition! Whoever is able to conduct the biggest supply chain operation using the now open source Shai Hulud worm will be congratulated and will receive a prize of $1000 USD in XMR from @diencracked. Make sure to read the rules posted in the announcement first.
