Shai-Hulud/Megalodon: A Two-Wave AI Developer Supply Chain Attack Key Takeaways In May 2026, the threat actor TeamPCP executed two coordinated attack waves against the AI developer supply chain, each exploiting a distinct layer of the software delivery pipeline within a span of three weeks.