TeamPCP Expands Supply-Chain Campaign Across Docker Hub, VS Code, NPM and PyPI
Summary
TeamPCP’s campaign spread from Trivy to Docker Hub, OpenVSX, NPM, Kubernetes and PyPI, using compromised credentials and malicious packages. Researchers report broad credential exposure and a wiper targeting Iran-configured systems.
Key points
- Attackers used modified GitHub Actions tags and malicious Trivy releases to steal credentials; SANS reports that more than 10,000 CI/CD workflows were affected.
- Aqua said the Trivy attack was contained and in remediation, but malicious Docker Hub images appeared after containment efforts began.
- TeamPCP published malicious Checkmarx VS Code plugins; SANS says 35 GitHub Action version tags were hijacked. Checkmarx removed the artifacts and advised affected users to rotate credentials.
- The NPM campaign affected at least 64 packages and more than 140 package artifacts. The CanisterWorm payload could use stolen publishing tokens to spread to additional packages.
- A Kubernetes payload included a wiper that Aikido says targeted Iran-configured systems, alongside lateral movement using compromised SSH keys and exposed Docker APIs.
- LiteLLM versions 1.82.7 and 1.82.8 were injected with credential-stealing malware. Vx-Underground claimed the attack exfiltrated about 300GB from around 500,000 infected machines.
- TeamPCP’s apparent partnership with Lapsus$ is not confirmed; the article bases the suggestion on the groups’ public Telegram claims.
Article Details
- Event Type
- Multi-platform open-source software supply-chain campaign involving compromised repositories, packages, plugins, and container images; reported activity includes credential theft, malware propagation, and destructive payloads.
- Impact
- The campaign affected Trivy, Checkmarx’s KICS project, NPM packages, Kubernetes clusters, and LiteLLM on PyPI. SANS Institute reported that more than 10,000 CI/CD workflows were affected by the Trivy incident; the NPM attack affected at least 64 packages and more than 140 package artifacts. ReversingLabs said the compromised VS Code plugins had over 36,000 combined downloads. Vx-Underground reported approximately 300 GB of data exfiltrated from around 500,000 infected machines. The Kubernetes payload was reported to wipe clusters on systems it identified as configured for Iran.
MITRE ATT&CK
T1021.004 · SSHA Kubernetes-targeting variant used SSH with compromised keys for network-based lateral movement, according to Aikido.T1059.006 · PythonThe NPM attack used a Python payload and, in later iterations, a hardcoded Python dropper.T1195.001 · Compromise Software Dependencies and Development ToolsThe campaign distributed malicious packages, plugins, container images, and modified GitHub Actions through compromised software supply-chain components.T1485 · Data DestructionThe payload called “kamikaze” reportedly erased host filesystem contents and destroyed targeted Kubernetes clusters.
CVE
People
Threat Actors
LAPSUS$The article describes Lapsus$ as an extortion group that claimed an upcoming TeamPCP supply-chain attack; a partnership between the groups is presented as apparent, not confirmed.TeamPCPThe campaign’s attacks on Trivy, Checkmarx’s KICS project, NPM, Kubernetes, and LiteLLM are attributed to TeamPCP. The article says the group took credit for several attacks.
Malware
Vendors
Aqua SecurityThe attack on Aqua Security’s widely used Trivy vulnerability scanner started with the compromise of an access token in late February.CheckmarxThe Checkmarx attackXygeniIn early March, a similar attack hit Xygeni: compromised credentials linked to repository automation were used to introduce malicious code. Initially, the attackers relied on pull requests, but when that failed, they
Products
Docker HubThe TeamPCP hacking group has expanded its open source software campaign from the Trivy supply chain attack to NPM, Docker Hub, VS Code, and PyPI, and likely partnered with the Lapsus$ gang for monetization purposes.GitHub Actionsas CVE-2026-33634 (CVSS score of 9.4), the hackers released malicious package versions and modified GitHub Actions tags to push information-stealing malware that would harvest credentials, keys, tokens, and otherKICSOn March 23, TeamPCP hit Checkmarx’s KICS open-source project, publishing malicious versions of the checkmarx.cx-dev-assist and checkmarx.ast-results VS Code plugins to the OpenVSX marketplace.KubernetesPCPcat, and ShellForce), which was behind a December worm-driven campaign that targeted Docker, Kubernetes, Ray, and Redis, and which also exploited the React2Shell vulnerability, according to Flare.LiteLLMThe PyPI attack and LiteLLM compromisenpmThe TeamPCP hacking group has expanded its open source software campaign from the Trivy supply chain attack to NPM, Docker Hub, VS Code, and PyPI, and likely partnered with the Lapsus$ gang for monetization purposes.OpenVSXOn March 23, TeamPCP hit Checkmarx’s KICS open-source project, publishing malicious versions of the checkmarx.cx-dev-assist and checkmarx.ast-results VS Code plugins to the OpenVSX marketplace.PyPIThe TeamPCP hacking group has expanded its open source software campaign from the Trivy supply chain attack to NPM, Docker Hub, VS Code, and PyPI, and likely partnered with the Lapsus$ gang for monetization purposes.TrivyThe TeamPCP hacking group has expanded its open source software campaign from the Trivy supply chain attack to NPM, Docker Hub, VS Code, and PyPI, and likely partnered with the Lapsus$ gang for monetization purposes.VS CodeThe TeamPCP hacking group has expanded its open source software campaign from the Trivy supply chain attack to NPM, Docker Hub, VS Code, and PyPI, and likely partnered with the Lapsus$ gang for monetization purposes.