Self-propagating malware poisons open source software and wipes Iran-based machines

A new hacking group called TeamPCP has been conducting a persistent campaign spreading self-propagating malware that poisons open-source packages and wipes data on Iran-based machines. The group compromised the Trivy vulnerability scanner via a supply-chain attack and deployed worm-enabled malware that automatically infects npm packages using stolen access tokens. The worm uses an Internet Computer Protocol-based canister as a tamper-proof command-and-control mechanism, allowing attackers to dynamically swap server URLs.