A threat actor behind a series of npm and PyPI supply chain attacks from March 2026 onward, identified by shared tooling and the "TeamPCP" label in attacker repositories. It compromises or clones publishing accounts for high-download packages -- including telnyx, lightning, intercom-client, and SAP CAP packages -- to inject credential-stealing payloads.