TeamPCP Supply-Chain Attacks Poisoned Trivy, KICS, LiteLLM, Telnyx, and Bitwarden

A broad software supply-chain campaign attributed to TeamPCP compromised trusted developer and security tools, beginning with a poisoned Trivy GitHub Action after attackers allegedly stole a personal access token via a misconfigured pull_request_target workflow. Researchers said malicious commits were pushed to most Trivy action tags, allowing the attackers to steal CI/CD secrets, cloud credentials, SSH keys, Kubernetes configuration, and other sensitive data from downstream users. The campaign then spread through stolen credentials to additional projects, including Checkmarx KICS, LiteLLM versions 1.82.7 and 1.82.8 on PyPI, the Telnyx SDK, and later Bitwarden CLI, with malware exfiltrating data to attacker-controlled infrastructure such as checkmarx[.]zone and models[.]litellm[.]cloud. Reporting also tied the operation to hundreds of compromised systems and large-scale theft of .env files and secrets from cloud, AI, payment, database, and messaging environments.

The fallout expanded beyond package poisoning into downstream intrusions and data leaks. Checkmarx confirmed that data later leaked by LAPSUS$ came from its private GitHub repository and said the initial access was likely enabled by credentials exposed in the Trivy-related compromise; researchers also linked the broader campaign to Bitwarden through shared malware and command-and-control patterns. Malicious KICS Docker images, GitHub Actions, and editor extensions were reported to steal credentials and scan results, while Bitwarden’s CI/CD workflow was allegedly abused to expose an npm token and publish a tainted @bitwarden/cli release. Security researchers and vendors warned that the campaign shows how attackers are increasingly targeting open-source maintainers and security tooling as high-leverage entry points, with reported ties to extortion and ransomware groups including LAPSUS$ and Vect raising the risk that stolen access will be resold or used for follow-on attacks.