A hacker group is poisoning open source code at an unprecedented scale

A hacker group known as TeamPCP has been conducting a significant number of software supply chain attacks, corrupting hundreds of open source tools to insert their malicious code. The group recently breached GitHub by installing a tainted extension for VSCode, compromising around 4,000 of GitHub's code repositories. TeamPCP has been actively carrying out these attacks, with cybersecurity firm Socket reporting over 20 waves of attacks in the past few months, affecting more than 500 software pieces. This ongoing spree of attacks has raised concerns about the security and trustworthiness of the software ecosystem.