TeamPCP’s Supply-Chain Campaign Used CI/CD Secrets to Spread Across Software Ecosystems

Apr 10, 2026 · Original article ↗

Summary

A detailed profile traces TeamPCP’s 2026 campaign from a Trivy CI/CD compromise through credential theft and propagation across package registries and developer tools, detailing its C2, persistence, exfiltration, and reported impacts.

Key points

The article traces the campaign’s initial access to residual Trivy token access after an incomplete credential rotation, which enabled a malicious release and poisoned GitHub Actions.
Payloads scraped runner process memory and filesystem paths for secrets, encrypted collected data in tpcp.tar.gz, and used victim-owned GitHub repositories as a fallback exfiltration channel.
Stolen publishing tokens enabled CanisterWorm to push malicious updates to 28 npm packages in under 60 seconds; the campaign also reached PyPI and OpenVSX.
Reported techniques include Internet Computer Protocol canisters for fallback command and control, Python payloads hidden in WAV files, and persistence through systemd services and privileged Kubernetes DaemonSets.
The article reports roughly 500,000 stolen credentials and more than 300 GB of exfiltrated data. It says CERT-EU attributed a European Commission AWS environment breach to TeamPCP, with about 92 GB of compressed data stolen.
The article describes the campaign as ongoing in early April 2026 and recommends rotating secrets, auditing for campaign artifacts, and pinning GitHub Actions to full commit SHAs.

Article Details

Attack Vectors: TeamPCP used residual access to a Trivy CI/CD service account token to push a malicious v0.69.4 tag and poison the release pipeline.
Compromised GitHub Actions harvested secrets from runner process memory and filesystem paths, including cloud credentials, tokens, SSH keys, and Docker configuration.
Stolen npm publish tokens enabled CanisterWorm to publish malicious updates to packages the token owners could modify; stolen PyPI tokens were used in the LiteLLM and Telnyx SDK compromises.
Compromised Checkmarx credentials were used to compromise GitHub Actions and OpenVSX extensions.
The payloads used WAV files containing base64-encoded Python payloads for delivery, and used privileged Kubernetes DaemonSets and malicious systemd services for persistence.
The campaign used typosquatted domains, Cloudflare Tunnel endpoints, and an ICP canister for command-and-control or exfiltration; a fallback uploaded encrypted archives to repositories in victims’ GitHub organizations.
The article reports SSH key harvesting to support lateral movement and a wiper targeting Iranian hosts.
Defensive Notes: Rotate credentials atomically after a compromise, including service-account tokens and package-publishing credentials.
Audit logs for tpcp.tar.gz and hunt for docs-tpcp and tpcp-docs repository names.
Pin GitHub Actions to full commit SHAs rather than mutable tags.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`checkmarx[.]zone`	C2 and second-stage delivery infrastructure used in the Checkmarx campaign.
HOSTNAME	`championships-peoples-point-cassette[.]trycloudflare[.]com`	Cloudflare Tunnel hostname reported as C2 for payload versions 3.0 and 3.1.
HOSTNAME	`create-sensitivity-grad-sequence[.]trycloudflare[.]com`	Cloudflare Tunnel hostname reported as active C2 for payload versions 3.2 and 3.3; it served kamikaze.sh and WAV payloads.
HOSTNAME	`plug-tab-protective-relay[.]trycloudflare[.]com`	Cloudflare Tunnel hostname used as a phase 02 exfiltration endpoint.
HOSTNAME	`scan[.]aquasecurtiy[.]org`	Typosquatted attacker-controlled C2 domain used to fetch malicious Go source files for the Trivy build pipeline.
HOSTNAME	`tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io`	ICP canister hostname used as fallback C2 infrastructure.
IPV4	`45[.]148[.]10[.]212`	C2 server reported to resolve for scan.aquasecurtiy[.]org.
IPV4	`83[.]142[.]209[.]203`	New C2 address reported in the compromised Telnyx Python SDK campaign.