TeamPCP: How a Supply Chain Attack Hit Build Systems and CI/CD Pipelines
TeamPCP Supply Chain Campaign: CI/CD Pipeline Attacks Targeting Trivy, KICS, and LiteLLM Date Observed: March 2026Ecosystem: GitHub Actions, npm, PyPITargets: Aqua Security Trivy, Checkmarx KICS, BerriAI LiteLLMAttack Type: Supply chain compromise, mutable tag hijacking, CI/CD credential theft, self-propagating worm, PyPI wheel backdoor Key Takeaways: TeamPCP is a threat actor behind a coordinated 2026 supply chain […]