TeamPCP Supply Chain Attack: The npm Worm That Hit GitHub, OpenAI, and Mistral AI

Between May 11 and May 19, 2026, a threat actor called TeamPCP poisoned 170+ npm/PyPI packages, hijacked a VS Code extension with 2.2M installs, and stole 3,800 internal GitHub repositories. Here's how the chain worked.