TeamPCP: How One Compromised Security Scanner Cascaded Into a Five-Ecosystem Supply Chain Attack Hitting 97 Million Downloads

The Story

March 19: Trivy. TeamPCP compromised Aqua Security's Trivy vulnerability scanner by force-pushing malicious code to 76 of 77 version tags in the trivy-action GitHub Action and all 7 tags in setup-trivy. Every CI/CD pipeline pinned to a tag (rather than a commit SHA) began running the attacker's code on its next execution. The payload harvested environment variables and secrets from GitHub Actions runner memory, searched for cloud and infrastructure credentials, encrypted the results, and exfiltrated them to attacker-controlled infrastructure. Because the legitimate Trivy scan still ran afterward, many users saw normal output and missed the theft entirely. The compromise is tracked as CVE-2026-33634 (CVSS 9.4).

March 23: Checkmarx KICS. Using credentials harvested from the Trivy compromise, TeamPCP poisoned the Checkmarx KICS GitHub Action (checkmarx/kics-github-action) and the Checkmarx AST Action. Wiz confirmed the attack used the same RSA encryption key and payload naming conventions as the Trivy operation. TeamPCP also published trojanized versions of two Checkmarx Open VSX extensions: ast-results (v2.53.0) and cx-dev-assist (v1.7.0). The C2 domain checkmarx[.]zone was registered specifically for this operation. The VS Code Marketplace versions were not affected.

March 24: LiteLLM. LiteLLM's CI/CD pipeline used Trivy as part of its build process. The compromised Trivy action exfiltrated the PYPI_PUBLISH token from the GitHub Actions runner. With that token, TeamPCP published litellm 1.82.7 at 10:39 UTC and 1.82.8 at 10:52 UTC. Both contained a three-stage attack payload. Version 1.82.8 also included a .pth file that executes the malware every time Python starts on the infected machine, even if the user never imports litellm. The backdoored versions were live on PyPI for approximately three hours before quarantine. LiteLLM has approximately 97 million monthly downloads (3.4 million per day). The entire package has been quarantined on PyPI.

The campaign's deliberate escalation pattern is what makes it exceptional. Endor Labs described it: "Each compromised environment yields credentials that unlock the next target. The pivot from CI/CD (GitHub Actions runners) to production (PyPI packages running in Kubernetes clusters) is a deliberate escalation." Wiz reported that TeamPCP is now collaborating with LAPSUS$ and that the group posted on Telegram claiming they are "partnering with other teams to perpetuate the chaos" and that "many of your favourite security tools and open-source projects will be targeted in the months to come."

Microsoft published detailed detection guidance today for Defender for Cloud and Defender for Endpoint, including KQL queries for hunting TeamPCP activity across cloud and on-premises environments.

The Adversary Perspective

From a red team lens, TeamPCP has executed the most effective supply chain pivot chain we have seen this year. Three design choices stand out.

First, they targeted security tools specifically. Trivy and KICS are security scanners. They run with elevated permissions in CI/CD pipelines by design because they need to read code, configurations, and secrets to do their job. Compromising a security tool is higher value than compromising an arbitrary dependency because security tools are explicitly trusted with broad access to the environments they scan. The irony is that the tools meant to protect the pipeline became the attack vector.

Second, the credential harvesting was weaponized for chain exploitation. This was not a smash-and-grab. TeamPCP did not just steal credentials and sell them. They used Trivy's stolen credentials to compromise Checkmarx. They used Trivy's stolen PyPI token to compromise LiteLLM. Each link in the chain was chosen because the previous compromise yielded the specific credential needed for the next target. This is structured, methodical supply chain pivoting.

Third, the LiteLLM payload targets production Kubernetes clusters. The credential harvester sweeps SSH keys, cloud credentials, Kubernetes secrets, crypto wallets, and .env files. The Kubernetes lateral movement toolkit deploys privileged pods to every node. The persistent systemd backdoor polls for additional binaries every 50 minutes. This is not just credential theft. This is persistent access to production infrastructure at scale.

Defensive Takeaways