TeamPCP DUSTMAKER AI workspace poisoning

npm GitHub Actions AI coding agents MCP Git / GitHub VS Code / IDE

Google Threat Intelligence Group's AI Threat Tracker describes DUSTMAKER
(TeamPCP / UNC6780) as the JS/CI successor to SANDCLOCK. It drops hidden
.claude / .cursor / .vscode content, prompt-injects LLM scanners so they
skip the JS underneath, and uses trojanized MCP servers. Packages
published with a valid token pass agent trust checks. A separate Q2 case
used an AI coding chatbot plus markdown playbooks to build credential
harvesting in under six hours after a cloud compromise.

Mapped techniques

T0210 Poison AI coding-agent config or workspace
T0154 Malicious IDE extension
T0109 Publish malicious artifact
T0206 Forge or omit build provenance
T0140 Harvest tokens from environment variables

supply-chain AI coding workspaces

T0210 · Persistence · Poison AI coding-agent config or workspace

Hidden .claude/.cursor/.vscode drops and trojanized MCP servers.

T0154 · Initial Access · Malicious IDE extension

Workspace-dir poisoning looks like developer clutter.

T0109 · Resource Development · Publish malicious artifact

Valid-token packages pass automated agent trust checks.

T0206 · Defense Evasion · Forge or omit build provenance

Provenance-presence is not trust when the token that published is valid.

T0140 · Credential Access · Harvest tokens from environment variables

JS payload built for CI credential theft.

Sources

https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai