TeamPCP Supply-Chain Campaign and AI Security Launches Lead Cybersecurity Roundup
Summary
TeamPCP’s cascading supply-chain campaign compromised security tools; reports link it to Mercor, where Lapsus$ claims to auction data including biometrics. The issue also covers AI-agent flaws and launches, other incidents, and mitigations.
Key points
- TeamPCP’s March 19–27 campaign began with Trivy, poisoning 75 of 76 action tags and binaries across multiple registries; stolen credentials then enabled compromises involving other tools and packages.
- Reports link the compromised LiteLLM package to Mercor. Lapsus$ claims to auction 4TB of data, including videos, face scans, and identity documents; the article does not independently verify the claim.
- Researchers disclosed an OpenAI Codex command injection involving unsanitized Git branch names that could expose GitHub OAuth tokens; OpenAI patched it on February 5, 2026.
- Researchers found overly broad default Vertex AI service-agent permissions could expose credentials and cloud resources; Google now recommends using a Bring Your Own Service Account approach.
- Handala claimed it breached FBI Director Kash Patel’s personal Gmail. The FBI confirmed older emails were published and said they contained no government information.
- Intoxalock confirmed a March 14 cyberattack that took systems offline, preventing breathalyzer-device calibration and leaving some drivers unable to start their vehicles.
- The RSAC roundup describes a wave of AI-agent security products focused on discovery, governance, and runtime enforcement; suggested measures include pinning dependencies to commit SHAs and auditing AI coding-assistant permissions.
Article Details
- Event Type
- Cascading software supply-chain campaign attributed to TeamPCP, involving compromised security tools, packages, and container images across multiple ecosystems.
- Impact
- The campaign reportedly compromised downstream organizations, including Mercor, where reports indicate the poisoned LiteLLM package entered through a development pipeline. Lapsus is described as auctioning 4TB of data, including source code, database records, video interviews, face scans, and identity-verification documents; the article does not independently confirm the full scope of that data exposure. The article also reports theft of GitHub OAuth tokens through an OpenAI Codex command-injection flaw, and an FBI-confirmed breach of Kash Patel’s personal Gmail account, with the FBI stating that the released materials were historical and contained no government information.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterA malicious Git branch name exploited OpenAI Codex’s unsanitized shell handling to execute arbitrary commands inside a container.T1078 · Valid AccountsTeamPCP reportedly used credentials retained from an incomplete remediation to force-push malicious code to Trivy action tags.T1195.001 · Compromise Software Dependencies and Development ToolsTeamPCP poisoned software packages, security tools, and container images, compromising software dependencies and development tools.T1528 · Steal Application Access TokenThe Codex command-injection flaw could extract a plaintext GitHub OAuth token from the container.
CVE
People
Threat Actors
HandalaThe Iranian-linked group claimed responsibility for breaching Kash Patel’s personal Gmail account. The FBI confirmed the account breach, but the article does not report independent confirmation of Handala’s attribution.LapsusThe article states that Lapsus is auctioning data allegedly obtained in the Mercor breach, including source code, records, interviews, face scans, and identity-verification documents.TeamPCPThe article attributes a March 19–27 cascading software supply-chain campaign to TeamPCP, including compromises involving Trivy, Checkmarx tools, LiteLLM, and other packages or images.
Malware
Vendors
Aqua SecurityTeamPCP launched a cascading software supply-chain attack starting with Aqua Security’s Trivy, poisoning packages and container images across multiple registries.CheckmarxThen Checkmarx KICS and AST GitHub Actions fell.GoogleSeparately, Palo Alto Networks Unit 42 showed how AI agents on Google Cloud’s Vertex AI could be weaponized into “double agents” by exploiting overly broad default service agent permissions (P4SA).OpenAINotable vulnerabilities included an OpenAI Codex branch-name command injection and overly broad Vertex AI service agent permissions that enabled credential theft.
Products
Axios>npm axios attackCodexlaunches and large funding rounds—while highlighting high-impact incidents like the Mercor breach, Codex command-injection, Handala’s Gmail compromise, and Intoxalock’s outage.LiteLLMThen LiteLLM, the open-source proxy routing API calls to 100+ LLM providers (95M monthly PyPI downloads).Vertex AINotable vulnerabilities included an OpenAI Codex branch-name command injection and overly broad Vertex AI service agent permissions that enabled credential theft.