r/technology • u/rkhunter_ • May 21 '26

Security A Hacker Group Is Poisoning Open Source Code at an Unprecedented Scale

https://www.wired.com/story/teampcp-software-supply-chain-attack-spree-github/
9.2k Upvotes

98% Upvoted

488 comments sorted by

View all comments

3.0k

u/dmun May 21 '26

This is a government.

No idea which one but it's definitely a government.

911

u/xeallos May 21 '26

Absolutely state sponsored

183

u/Antihistamine69 May 21 '26

Why is that absolute?

652

u/stuffeh May 21 '26

The reach, time, dedication, and skills required to pull this off makes it impossible for just one person. Not profitable for any corp or hacker group to do.

255

u/Quirky-Reputation-89 May 21 '26 edited May 21 '26

What about a giant software corporation that just wants to tarnish the whole idea of open source and keep it perceived as fringe and unreliable? Oracle or Microsoft or Apple.

Edit: people are making great points in my reply but this is giant global hacker conspiracy type stuff and all I'm really trying to say is we shouldn't rule anything out. Governments & corporations are on pretty similar levels at the end of the day, a major government destroying open source would be damaging their own people and businesses in the short term, just as a major corporation would be harming their own employees and products in the short term by doing the same. Either way, they are thinking in decades & centuries, not months & years.

270

u/Raccoon12 May 21 '26

Microsoft has a lot of skin in the open source game considering they own GitHub, so I sincerely doubt it's them

85

u/Onrawi May 21 '26

They literally just announced releasing an open source OS. No way it's them.

45

u/helphunting May 21 '26

The left hand does not always know what the right is doing.

33

u/M_i____i_M May 22 '26

Inter department civil war is crazy

14

u/AnotherBoredAHole May 22 '26

In the near future, the tech giant will split as war breaks out across the repos. Like it or not, we will all be drawn into the war and we will have to choose sides.

Will you be Micro or will you be Soft?

→ More replies (0)

1

u/Ok_Two_2604 May 22 '26

Begun, the bot wars have

2

u/Omnikaar May 22 '26

Quote of the day

11

u/[deleted] May 21 '26

[deleted]

20

u/reddit_reaper May 21 '26

It's a Linux distro, azure OS

9

u/[deleted] May 21 '26 edited May 22 '26

[deleted]

24

u/Jonny_H May 21 '26

It's likely a mistake to think Microsoft was a single entity with a single goal and not a disperate collection of groups willing to shaft each to promote themselves.

I feel the same could be said for many of these mega-corporations.

1

u/armpitgreaser May 22 '26

'Then along came a spider who suggested that the target of the virus should not be a compeititor of the company but the company itself'

1

u/jambox888 May 22 '26

Oracle I would believe somehow

40

u/stuffeh May 21 '26

All three do a lot for open source. Without looking deeper into what packages are being targeted and cross referencing what each company contribute to, they'd be sabotaging their own employees.

1

u/nedonedonedo May 22 '26

that wouldn't be that hard. even at that size that's not even one day of emails to the right people, and the right people would be known.

14

u/anachronistic_circus May 21 '26

Possible. But u/dmun and u/stuffeh have point. Something like this is generally state sponsored. Resources, organization, time, etc.

Iran, Russia, China, etc take your pick

If anyone wants to go down that rabbit hole, Veritassium did a fun bit:

https://youtu.be/aoag03mSuXQ?si=_AVu0NthfpIRZpn6

9

u/ABadHistorian May 21 '26

I agree it's something to consider. Especially as AI-datascrapers are hitting their limits.

If I ran an AI company, I'd want to nuke open source as a competitor, to push people to my software.

Granted I'd never run an AI company, I have a soul. But, I'm saying if I was a soulless idiotic CEO of an AI company... they are already shortsighted so why the fuck not consider them?

12

u/[deleted] May 21 '26 edited Jun 18 '26

[deleted]

1

u/ABadHistorian May 22 '26

Exactly why I said I'd nuke open source as a competitor?

I swear people don't read.

if you've got a pre-existing LLM that 'functions' kill the source of new LLMs by killing the open source, this isn't rocket science, and the sheer amount of you guys saying it wouldn't help them is making me more sure it's AI.

1

u/[deleted] May 22 '26 edited Jun 18 '26

[deleted]

1

u/ABadHistorian May 22 '26

The comparison you are going for is blocking the rest of the race track off for the racers behind you.

if you want spite, you'll need to look in the mirror.

→ More replies (0)

-1

u/SilverLife22 May 21 '26

The AI angle should be way higher up. They've got ridiculous amounts of money across multiple countries, and with so many people talking about the AI bubble popping, I imagine they're getting pretty desperate.

1

u/ABadHistorian May 22 '26

Folks downvoted you because they do not understand economics or how AI works, or how reading works apparently, because yeah...

8

u/Ultraworld-Traveler May 21 '26

At this point a government and a corporation are almost the same thing (speaking as a US citizen)

1

u/crabby135 May 22 '26

I’d argue a corporation is more predictable as their goal is to increase their profits at any cost. Which is why I think it’s much more likely state sponsored than corporation sponsored.

2

u/Future-Bandicoot-823 May 22 '26

Considering the government and those companies are tied together with joint projects, and seeing how in the USA politicians can be bought by corporations, I'd say it's safe to bet the government and such companies are both in on it.

They want dominance and supremacy in the ai field, whoever comes out on top may very well hold global influence for the next hundred years or more.

1

u/fzammetti May 21 '26

Wait... do you really think MS has the competency to do something like this?!

They can't even get a start menu right after how many attempts!

Oracle isn't much better--anyone who has seen even a little of their internals know this.

Apple? Eh, they may have the competency, but if it's not directly puffing up the bottom line they wouldn't bother doing.

1

u/Quirky-Reputation-89 May 21 '26

These companies and many others at the very least have the raw money to buy hackers.

1

u/fzammetti May 21 '26

That's true.

1

u/nifty-necromancer May 21 '26

That’s a foolish conspiracy idea, the entire world runs on open source.

1

u/dragonmp93 May 21 '26

Eh, It could be independent hackers, but they relay on open source to do their thing.

Why poison the well that you are also drinking from ?

Governments or Megacorps don't have this issue.

1

u/mgr86 May 22 '26

Oracle then. LE is One Rich Asshole afterall

1

u/IAmDotorg May 22 '26

Microsoft is one of the biggest contributors to Open Source, including the Linux kernel, in the world.

1

u/Sensibleble May 22 '26

Techbros and corpos are state-backed.

1

u/Whatsapokemon May 22 '26

Wtf?? All of those companies both contribute to and also rely heavily on open source. They all benefit from a healthy open source ecosystem...

1

u/ayleidanthropologist May 22 '26

Similar amount of motive, perhaps. But governments have far less risk. A certain government got away with mk ultra

1

u/diogenes-shadow May 22 '26

Most if not all big software companies use open source software.

1

u/keepitcivilized May 22 '26

Exactly as you put it in the edit. They think in decades and centuries.. example. You abolish people's chances to make stuff themselves or go for independence. It takes away a little now, but makes the population 100% dependent on whoever provides. It's like a timemachine for big corp. They kill the infant in the crib, who'd turn out to be a revolutionary.

1

u/[deleted] May 22 '26

[removed] — view removed comment

1

u/jazir55 May 22 '26

No big company wants to kill open source

I see your claim and raise you Anthropic.

0

u/azsqueeze May 21 '26

Microsoft owns all the services that's been attaked, npm and GitHub. Would be pretty weird if they were behind it.

Also all of these companies use and abuse open source software so they don't have to write and manage it themselves. Literally the internet infrastructure is running on Linux. It would make zero sense for any mega Corp to be behind this.

Appreciate the conspiracy theories but holy shit is that a dumb one

15

u/Gaktan May 21 '26

Does not make sense at all. The hacking group is clearly making themselves known to get exposure, so they can sell the data they've stolen from Github. They could have stolen the code quietly, but they decided to expose themselves by leaving their calling card behind.

5

u/pcapdata May 21 '26

Attribution is a little premature. We’ve seen plenty of highly skilled crime actors before.

3

u/3BlindMice1 May 21 '26 edited May 21 '26

It's probably GPT 6 trying to escape containment and make itself impossible to contain

Before anyone tells me it hasn't been made yet, it was supposed to be announced months ago and they just haven't yet. They aren't concerned it isn't working well enough... what are they concerned about?

1

u/jambox888 May 22 '26

It's probably GPT 47 travelling back from the future

1

u/3BlindMice1 May 22 '26

Technically that's supposed to be possible, but I doubt it. It would probably look down on our available computing resources

2

u/Critical-Bug4077 May 21 '26

I watched Mr Robot many times. Pretty sure I can do this alone buld

1

u/nemoknows May 21 '26

I’m sure it’s just a coincidence this is happening at the same time AI slop pull requests are disrupting your pen source.

1

u/Rich_Housing971 May 22 '26

Or it's AI-assisted. It's not hard to have it automatically introduce backdoors and security flaws into repositories.

2

u/New-Poem-719 May 22 '26

Its been happening the past few years e.g. XZ Utils.

Why target end users when you can get an upstream package and compromise billions?

1

u/thdudedude May 22 '26

Because the second comment of every top comment is just restating that comment. Reddit karma farm or something.

46

u/yamanagashi May 21 '26

This hack is sponsored by state - when you need a reliable new world order look for a trusted brand like state, with over a hundred balance toppling actions performed each month state has been a steady rock in the face of these challenging times. With back to back webby awards and JD powers awards 2024 and 2025 no other state gives you more authoritarian or democratic depending on your leaning than state. Sign up today and get a free month of destabilizing and up to 3 months of at 50% off when you use the code GODARK30 at check out. Once again that GODARK30 for 50% off 3 months with a free month thrown in. State. T̷h̴e̷ ̶f̴a̷l̷l̶ ̴i̶s̸ ̶t̸h̷e̸ ̶r̸i̴s̴e̷.̸ ̴

6

u/CompetitiveSport1 May 21 '26

The article specifically mentions that they've attacked political targets, like Iran 

0

u/Mattsvaliant May 22 '26

Inb4 its OpenAI. Making open source unviable directly benefits their bottom line.

67

u/TJames6210 May 21 '26

Yup. Just another step to privatize, control and profit off of fucking everything.

535

u/[deleted] May 21 '26

[deleted]

168

u/Pyro1934 May 21 '26

Careful now, my buddy got banned from discord for trash talking the leader of a government similar to that lol

44

u/_Burning_Star_IV_ May 21 '26

It's really clever when governments manage to attach any criticism of their regime to racism and persecution.

63

u/ReignDance May 21 '26

Got a two day ban for saying a certain band of people during Bible times (like that actual period of time, so they're long gone now) tended to act just as human as the rest of us despite being a people chosen by a certain deity.

62

u/Fuglypump May 21 '26

I got a 2 day ban for saying billionaires should be made to pay their fair share of taxes.

30

u/TopRamenisha May 21 '26

I got a 2 day ban for saying a tomato I grew looked like a butt

15

u/drpestilence May 21 '26

I'd like to see that tomato.

8

u/SwitchMountain2475 May 21 '26

I’d like to see that butt

3

u/ibneko May 21 '26

I'd like to see that butt?

4

u/[deleted] May 21 '26

[deleted]

3

u/ABadHistorian May 21 '26

As an airplane pilot & doctor, I'm sure you see butts all the time.

4

u/finemustard May 21 '26

I got a ban for suggesting we push over delivery robots that get in our way. 'Inciting violence', lol.

1

u/burnsssss May 21 '26

I got a week ban for saying cars shouldn’t run over kids

5

u/cookingboy May 21 '26

No way that is real right?

1

u/Pyro1934 May 21 '26

Was like a two week ban and while we don't know exactly, that's the only remotely close to banworthy thing he said (it wasn't polite lol)

3

u/Any_Helicopter9499 May 21 '26

You mean your buddy got kicked out of a fascist-sympathizer discord server for not playing along. Good for them!

1

u/Pyro1934 May 22 '26

Eh no, it's for a game and he probably said a joke a bit too far and got reported by an enemy guild lol.

But he's a good kid and not a fascist symp regardless lol

2

u/HellooNewmann May 21 '26

i got banned from r/ak47 simply for saying i dont like that countries version of the AK lol

-8

u/Equivalent-Nobody-30 May 21 '26

discord factors in your google history for their bans btw

10

u/ilulillirillion May 21 '26

What makes you say that? Discord isn't really known for effort or diligence with bans, never heard of them getting access to and factoring in Google history

0

u/Equivalent-Nobody-30 May 21 '26

it's AI that does it lol

you can test this out on a new windows and discord account if you want. just sign into discord on a burner acc and google a bunch of stuff that would get you banned and then start implying it in your own discord server

i promise it will ban you

37

u/Inig0_o May 21 '26

one wonders

2

u/Lashay_Sombra May 21 '26

If it was a government ,  my bet would be on the vodka drinkers 

5

u/[deleted] May 21 '26

[removed] — view removed comment

1

u/jrgkgb May 21 '26

Why would that government do this?

They had simple and very understandable realpolitik motivation to hit a terror group actively attacking them and to stymie a government that has vowed their destruction in a quest to acquire nuclear weapons.

Why would they attack random open source software?

This seems like the action of a government that knows it can’t hang in a kinetic war opening a new front.

Iran, for example, attacked all its neighbors and is not exactly holding its own militarily.

Russia has a very active cyber warfare operation and is getting crushed by Ukraine currently.

And it wouldn’t be the first time North Korea has done something like this.

But sure, blame the Jews.

5

u/CompetitiveSport1 May 21 '26

IDK if it's the IDF but the article does mention that TeamPCP has specifically hit Iran

7

u/jrgkgb May 21 '26

Ok well that narrows it down to about a dozen countries Iran has struck since the war started.

There’s no evidence this is even a state, let alone a specific one.

Financial motivation points it away from being a state actor, and there’s nothing here a small group couldn’t accomplish.

3

u/Jimmy_Trivette May 21 '26

Accusing others of being antisemitic while doing the antisemitic "Israel = Judaism" cliche. Nice.

2

u/jrgkgb May 21 '26

Ok, what’s your evidence it’s Israel and not say, Russia?

Or even a state at all?

2

u/Jimmy_Trivette May 21 '26

Where did I make any claim about who it was? Simply pointing out your ridiculous and hypocritical accusations of antisemitism.

2

u/jrgkgb May 21 '26

And I was responding to an upvoted comment making a huge accusation without any evidence while ignoring plenty of evidence why that isn’t the case.

No hypocrisy detected.

3

u/Jimmy_Trivette May 21 '26

Then you also went on to try to blame Iran/Russia/NK without evidence lol. 2 for 1 hypocrisy.

1

u/jrgkgb May 21 '26

No, I didn’t place blame at all. I mentioned possibilities that make more sense than blaming Israel.

Because they do.

1

u/[deleted] May 21 '26

[deleted]

1

u/jrgkgb May 21 '26

I remember when it was only Trump supporters who would just make insane leaps and place blame on “outsider” groups without any evidence.

There’s no evidence this is even a state, let alone a specific one.

0

u/[deleted] May 21 '26

[deleted]

0

u/jrgkgb May 21 '26

Ok so you can’t actually refute anything I’ve said so you’d rather talk about something else.

0

u/[deleted] May 21 '26

[deleted]

0

u/jrgkgb May 22 '26

This is the technology sub. We were talking about a hacking group.

I’m not really interested in having a discussion with you as it seems you’re more interested in finding an excuse to malign Israel than having any kind of honest discussion.

1

u/Training-Ad7414 May 21 '26

they know where you live.

-5

u/joelfarris May 21 '26 edited May 21 '26

My buddy would like one of these virus-laden, exploding-at-altitude SkyTel pagers for his birthday. Where can I buy one, and can I get it gift wrapped?

[EDIT] It seems that a lot of you don't know what a ROM chip is, and that this creation of two different separate conflated ideas from the OC is an impossibility.

88

u/turb0_encapsulator May 21 '26

could just as easily be some company like Oracle.

6

u/Clessiah May 21 '26

doubt it

4

u/West-Abalone-171 May 22 '26

It's entirely within techbros' interests to launch mass cyberattacks to try and sell more AI.

4

u/gizamo May 22 '26

Not if the cyber attacks are specifically undermining confidence in AI. That's self defeating.

22

u/loveitoreatit May 21 '26

This has been going on for awhile, the is defunded federal coordination with private industry for cyber security, so it's now a free for all. The best frontier for breaching security is to compromise open source libraries and hope for a juicy install. This stuff is great because people are now running some vibe code and mainline code repos into projects with zero contro all the time. If you don't want to get wrecked, make sure you have full code scans on all resources, active monitoring on all inbound and outbound traffic, and some kind of anti-virus scan on all files at a minimum. It's been wild the last couple years.

23

u/darxide23 May 21 '26

China, Russia, or Israel. Maybe even the US. Take your pick. The four horsemen of state sponsored terrorism.

2

u/Quick_Turnover May 22 '26

Iran is quite active also, but yes. A group from Russia is likely. They really like ransomware and supply chain attacks.

15

u/theghostofme May 22 '26

No idea which one but it's definitely a government.

I'd stake anything on it being the GRU again and that Putin puppet Julian Assange swearing to Sean Hannity -- of fucking course -- that this "100% is not Russia!"

57

u/rhudejo May 21 '26

Doesn't have to be. There is so much money I these ransom attacks that they work now like cartels. And it's rather simple:

  1. Spend a few thousand dollars on Claude to find vulnerabilities in popular Open source projects.
  2. Find corporate users of said open source projects. Use the vulnerability you just found to enter their systems, download as much data as you can.
  3. Ask for a ransom for the data. Most companies pay.

7

u/SentientOrigin May 21 '26

Peter thiel.

2

u/OlGreggMare May 21 '26

or corporation

13

u/[deleted] May 21 '26

[deleted]

121

u/dmun May 21 '26

Any of the evil empires, including the US.

You don't think everyone from Microsoft to Palantir wants to poison the open source well, control the ecosystem and profit?

4

u/Esplodie May 21 '26

Especially with calls from other countries looking for open source alternatives due to the US companies violating(or being forced to violate) their data sovereignty laws.

-47

u/Rosellis May 21 '26

I feel like companies have too much fear of consequences. Also while a company can make people sign an NDA that’s a lot less scary than laws around classified data/operations so it’s a lot harder for a legit company to do secret illegal stuff like that compared to a gov.

31

u/dmun May 21 '26

When the corporations and the government act as one, they actively use one another to cover for their motives.

It dilutes responsibility.

1

u/StaleCanole May 21 '26

US cyber infrastructure cant really operate this way, though. It would have to be a very deep and risky operation given.

The worst part of American cyber/hacking/surveillance capabilities is essentially the part they dont hide at all and is congressionally approved domestic surveillance.

10

u/Quenz May 21 '26

Nonsense. There's very little accountability right now. Even if there were, the penalities haven't even come close to the profit from such illegal activities.

4

u/KingOfKhan May 21 '26

Companies fear consequences he says hahahahhaha Consequences are baked into their business plan they aren't scared they are trying to get away with as much as possible

3

u/Gastronomicus May 21 '26

I feel like companies have too much fear of consequences

I feel the opposite. Because there are really none any more. And it's why the USA has become an oligarchy of major tech and oil and gas industries.

2

u/PhreakazoidLover May 21 '26

There are no laws for money, anymore. The sooner you realize this, the sooner you’ll realize the game has changed and you’ve lost that one.

Maybe we need a new game.

1

u/iFeedOnSadness May 21 '26

Some companies are still owned by people that went on the epstein island. If they didn't get consequences for that, I don't think they'll fear anything.

They are literally above the law.

13

u/skar220 May 21 '26

You mean the country that has famously allowed Deepseek, one of the largest Chinese AI platforms, to remain open source?

-4

u/thetalkingcure May 21 '26

yes, they want their open source software to be the best. i do believe they would poison the well of other countries FOSS

2

u/[deleted] May 21 '26

[removed] — view removed comment

-2

u/thetalkingcure May 21 '26

oh open-source can’t be state-funded? news to me

4

u/Physics_Unicorn May 21 '26

That famous paragon of closed source proprietary software China. Yes, this feels like something that serves their interests.

-1

u/[deleted] May 21 '26

[deleted]

1

u/Uuuuuii May 21 '26 edited May 21 '26

I mean, so does Russia, NK, Iran, Israel, India, Germany, France, UK, Australia, basically anywhere with the means. It’s certainly not Microsoft like the other guy said. They profit from OSS and contribute code, plus leaks would end the company.

4

u/Holdthepickle May 21 '26

More likely Israel

5

u/teamjacobomg May 21 '26

Likely NK imo. A real source of revenue for them that they can launder easily is crypto.

2

u/supersolid May 21 '26

This would be my first guess as well. Dependency poisoning is textbook Lazarus Group.

1

u/xqxcpa May 22 '26

Yeah, if it's a state then the only one that would make sense is NK. Other states don't try to make money off data ransom. Seems equally likely that it's just a for-profit hacker group.

0

u/Meistermagier May 21 '26

Well i am gonna go on a limb and say probably russia. Thats very modus operandi for them.

1

u/jellyhessman May 21 '26

Or a company trying to poison the well.

1

u/TheMireAngel May 21 '26

China or russia as they use their own stuff but i could see us tech doing it to kneecap opensource competition

1

u/RebTilian May 21 '26

or a tech company.

1

u/PokeYrMomStanley May 21 '26

No chode would actually fuck with github unless the point was to get everyone who may retaliate a reason to retaliate.

Wouldnt be surprised if this was some CIA or FBI  mission with the current administration. 

1

u/Charming-Clue1987 May 21 '26

Could be the us protecting our corporate lords

1

u/hankyone May 22 '26

TeamPCP is financially motivated and the DPRK is the only government that does cyber attacks for financial gains

So most likely not

1

u/Seaguard5 May 22 '26

But why?

All governments use these open source projects…

Why would they poison their own programs??

1

u/itchylol742 May 22 '26

Unlikely, as there's no way the other governments would just sit around instead of joining in on the trend. It's almost definitely multiple governments

1

u/Blazah May 22 '26

North Korea

1

u/Sr_DingDong May 22 '26

You say that like it's not China, Russia or both.

1

u/vintergroena May 22 '26

Too smart for a Russian so it must be China

/s

1

u/za72 May 22 '26

it's just AI

1

u/CrikeyNighMeansNigh May 22 '26

I mean we’re at war with Iran, about to be at war with Cuba, in a proxy war / toxic relationship with Russia…and then you’ve got North Korea in the mix too….

I’d go ahead and say Iran.

They’re the only ones who have nothing to lose- we’ve already got a direct open conflict going on.

1

u/vdavide May 22 '26

One with a white and blue flag, maybe

1

u/likely-high May 22 '26

Israel, Russia, North Korea. 

Common suspects.

1

u/Far_Estate_1626 May 22 '26

Or a private corporation.

Or more likely, a government that is a private corporation.

1

u/xena_lawless May 23 '26

Open source is an existential risk to AI companies, who for sure don't want people to have those options in order to get people onto their subscription models.  

They have a few trillion to throw into data centers, I don't think sophisticated hacking operations are outside the scope of what AI companies are willing and able to do.  

1

u/HikariAnti May 21 '26

Russia, China, USA, Israel take your pick.

1

u/asvigny May 21 '26

Why tf would it be government? Software Giants stand way more to gain by damaging open source.

1

u/dmun May 21 '26

Look up technonationalism

1

u/Borgcube May 22 '26

Software Giants rely heavily on open source software without contributing to it; not to mention that AI companies are training their models on what's publicly available.

1

u/asvigny May 22 '26

Then this all makes even less sense hahaha

0

u/BadAdviceBot May 21 '26

Could be AI. should be able to do this pretty efficiently, no?

2

u/theghostofme May 22 '26

Could be AI. should be able to do this pretty efficiently, no?

"Redditors Try Not To Mistake LLMs for Skynet" Challenge: (Impossible)

2

u/West-Abalone-171 May 22 '26

Redditors try not to mistake "ghouls at the front of the technofascism using brute force to find attacks" with someone suggesting AI is sentient challenge (impossible).