Google's Threat Intelligence Group ran an analyst inside TeamPCP, the group responsible for what Wired describes as the worst software supply chain hacking spree on record, breaching thousands of companies before Google surfaced the operation from the inside rather than reconstructing it after the fact. The placement was inside the group's inner communications, the layer where operational planning happens, not the malware repositories researchers usually pick apart post-breach. Most supply chain attribution runs backward from a compromised build pipeline or a poisoned package. This one ran forward, from inside the group planning the poisoning.

The distinction matters because supply chain compromises are usually understood only once the payload has already shipped downstream to every company that pulled the dependency. An analyst embedded in the group's internal channels sees the target selection and tooling decisions before they reach a build server, which is a different intelligence product than a post-incident indicator-of-compromise list. Thousands of companies were breached before this was public. The visibility Google is describing would have applied to targeting decisions made before those breaches occurred, not after.

The named thing here is Google's Threat Intelligence Group and the TeamPCP operation itself, not a specific malware family or CVE, because Wired's reporting centers on the human placement rather than a technical artifact. That is itself notable: the most consequential supply chain finding of the week is a source, not a signature. Thousands of breached companies is the number that settles how serious TeamPCP's run actually was.