Loading story…
The TeamPCP software supply-chain campaign compromised CI/CD tooling and packages including Trivy, KICS, LiteLLM, Telnyx, CanisterWorm, and more than 66 npm packages. Malicious code deployed TeamPCP Cloud Stealer to collect GitHub, cloud-provider, SSH, and package-manager credentials; on GitHub-hosted Linux runners, it dumped Runner.Worker process memory to extract secrets. Stolen credentials were reportedly reused to move between victims and expand the compromise chain.
The LiteLLM intrusion reportedly added Kubernetes lateral-movement features, Python .pth persistence, and exfiltration to attacker-created GitHub repositories. Organizations using affected build pipelines should rotate potentially exposed credentials, review CI/CD logs and runner activity for memory-dumping behavior and unauthorized repository access, and investigate package versions and build artifacts for tampering. Canary credentials placed in runner files, environment variables, and memory can provide early alerts when credential-stealing malware accesses or uses decoy secrets.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
Two malicious versions of the Telnyx PyPI package were reportedly published. The campaign assessment linked this compromise to credentials likely obtained from the previously compromised LiteLLM environment.
Two malicious versions of the LiteLLM PyPI package were reportedly published. The compromised payload included credential theft and Kubernetes-focused lateral-movement capabilities.
GitHub Actions and OpenVSX extensions associated with Checkmarx's KICS scanner were reportedly compromised.
Credentials stolen in the Trivy compromise were reportedly used to compromise more than 66 npm packages through the self-propagating CanisterWorm.
Several GitHub Actions associated with Aqua Security's Trivy scanner were reportedly compromised. Malicious Trivy versions were also published to Docker Hub as part of the campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A broad software supply-chain campaign attributed to **TeamPCP** compromised trusted developer and security tools, beginning with a poisoned **Trivy GitHub Action** after attackers allegedly stole a personal access token via a misconfigured `pull_request_target` workflow. Researchers said malicious commits were pushed to most Trivy action tags, allowing the attackers to steal CI/CD secrets, cloud credentials, SSH keys, Kubernetes configuration, and other sensitive data from downstream users. The campaign then spread through stolen credentials to additional projects, including **Checkmarx KICS**, **LiteLLM** versions `1.82.7` and `1.82.8` on PyPI, the **Telnyx SDK**, and later **Bitwarden CLI**, with malware exfiltrating data to attacker-controlled infrastructure such as `checkmarx[.]zone` and `models[.]litellm[.]cloud`. Reporting also tied the operation to hundreds of compromised systems and large-scale theft of `.env` files and secrets from cloud, AI, payment, database, and messaging environments. The fallout expanded beyond package poisoning into downstream intrusions and data leaks. **Checkmarx** confirmed that data later leaked by **LAPSUS$** came from its private GitHub repository and said the initial access was likely enabled by credentials exposed in the Trivy-related compromise; researchers also linked the broader campaign to **Bitwarden** through shared malware and command-and-control patterns. Malicious KICS Docker images, GitHub Actions, and editor extensions were reported to steal credentials and scan results, while Bitwarden’s CI/CD workflow was allegedly abused to expose an npm token and publish a tainted `@bitwarden/cli` release. Security researchers and vendors warned that the campaign shows how attackers are increasingly targeting open-source maintainers and security tooling as high-leverage entry points, with reported ties to extortion and ransomware groups including **LAPSUS$** and **Vect** raising the risk that stolen access will be resold or used for follow-on attacks.
Jul 4, 2026
TeamPCP has expanded a multi-ecosystem software supply chain campaign that compromised open-source security and developer tools including **Trivy**, **Checkmarx KICS**, **LiteLLM**, **Telnyx**, GitHub Actions, OpenVSX extensions, Docker images, and packages published through **PyPI** and **npm**. Reporting indicates the attackers used stolen developer and publishing credentials to push malicious releases through trusted channels, harvest environment variables, shell histories, cloud credentials, and GitHub tokens, and move laterally across CI/CD environments. In the Telnyx incident, valid credentials were reportedly used to publish malicious PyPI releases, with a second-stage payload hidden in a WAV file and code triggered on import. The campaign is now being linked to follow-on ransomware activity through an alleged partnership between TeamPCP and the **Vect** ransomware group, which has been advertised on BreachForums as an emerging ransomware-as-a-service operation. Researchers say the supply chain compromises may serve as initial access for extortion campaigns against downstream organizations, with TeamPCP reportedly recruiting negotiators after the Trivy breach and previously exfiltrating roughly **300 GB** of compressed credentials; the LiteLLM compromise alone was tied to hundreds of thousands of stolen credentials. The incidents underscore how compromised open-source tooling and CI/CD infrastructure can give attackers privileged enterprise access and create a path from package poisoning to ransomware deployment.
Aug 26, 2026
The FBI issued a FLASH warning that **TeamPCP** is carrying out large-scale software supply chain compromises by trojanizing trusted developer and security tools, including **Trivy**, **KICS**, **LiteLLM**, and the **Telnyx Python SDK**. The campaign is designed to infiltrate CI/CD pipelines, cloud infrastructure, and security workflows, then steal high-value secrets such as cloud access tokens, API keys, SSH keys, and Kubernetes secrets. Reporting tied to the alert describes TeamPCP as a financially motivated group whose operations show persistence and scale more commonly associated with advanced threat actors. Authorities and researchers said the activity is linked to malware families including **CanisterWorm**, **SANDCLOCK**, **Mini Shai-Hulud**, and **Miasma**, which were used to establish persistence, exfiltrate credentials, and spread access into downstream victim environments. The FBI said the group has also engaged in extortion, published victim names on a leak site, and collaborated with other threat actors, raising the risk that stolen credentials will be reused long after the initial compromise. Defenders were urged to rotate exposed secrets, pin GitHub Actions to verified commit SHAs, hunt for worm-created repositories, harden CI/CD environments, and review published indicators such as domains, IP addresses, hashes, and related CVEs.
Jul 9, 2026