A so-called software supply chain attack, where hackers corrupt legitimate software to hide their malicious code, has become a near-weekly occurrence. GitHub recently announced it had been breached by the notorious TeamPCP, who have poisoned hundreds of open source tools and extorted victims for profit.

The breach revealed that TeamPCP claims to have accessed around 4,000 of GitHub’s code repositories, offering samples to potential buyers to prove the authenticity of their claim. This latest incident is part of what cybersecurity firm Socket calls the longest-running spree of software supply chain attacks ever, with no end in sight.

TeamPCP has carried out over 20 waves of attacks in recent months, hiding malware in more than 500 distinct pieces of software. The extent of this attack highlights a new level of distrust in an ecosystem that was once considered safe and reliable for developers around the world.

This breach underscores the importance of robust security measures not just for large platforms like GitHub, but for all users of open source tools. As the line between development and cyber crime continues to blur, it’s clear that no code is entirely immune from corruption.