---
id: 6832
title: "The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/mini-shai-hulud-teampcp-hits-antv-supply-chain"
published_at: "2026-05-19T08:29:30Z"
tags: ["supply-chain", "malware", "credential-theft", "github-actions", "npm", "vscode", "teampcp"]
phying_url: "https://phying.com/item/6832"
lang: en
---

# The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave

## Summary

Wiz attributes the cross-ecosystem campaign to TeamPCP: @antv npm packages, actions-cool/issues-helper GitHub Action, and a VS Code extension steal credentials and drop a GitHub-polled backdoor.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2026-05-19T08:29:30Z
- **Original:** https://www.wiz.io/blog/mini-shai-hulud-teampcp-hits-antv-supply-chain
- **Phying News:** https://phying.com/item/6832