TeamPCP Supply-Chain Attacks Steal Credentials Through KICS and elementary-data

May 13, 2026 · Original article ↗

Summary

Trend Micro analyzes two TeamPCP supply-chain attacks that abused CI/CD and release workflows to distribute credential stealers, compromise downstream software, and access cloud secrets.

Key points

The campaign spans at least seven waves from March 19 to April 24, 2026, targeting developer tools, packages, registries, and CI/CD workflows.
On April 22, attackers poisoned Checkmarx KICS Docker images, VS Code/OpenVSX extensions, and a GitHub Action; stolen npm tokens were used the next day to hijack @bitwarden/cli.
On April 24, an unsanitized pull-request comment triggered elementary-data’s GitHub Actions workflow, letting the attacker create a malicious release without first stealing maintainer credentials.
The elementary-data package’s .pth payload ran at Python interpreter startup and harvested credentials, secrets, SSH keys, Kubernetes data, and cryptocurrency wallet files.
The stealer also used available AWS credentials to enumerate Secrets Manager secrets and retrieve secret values through live API calls.
The article recommends treating systems exposed to affected artifacts as compromised, rotating credentials from clean hosts, and reviewing workflow runs and cloud audit logs.
Structural mitigations include sanitizing user-controlled GitHub Actions inputs, pinning container images by verified digest, limiting CI permissions, and restricting runner network egress.

Article Details

Attack Vectors: TeamPCP poisoned Checkmarx KICS Docker Hub images, VS Code and OpenVSX extensions, and the checkmarx/ast-github-action workflow.
Stolen npm tokens from the KICS incident were used to publish a malicious @bitwarden/cli release.
A pull request comment injected a shell command into an elementary-data GitHub Actions workflow that interpolated the comment body into a run block without sanitization.
The elementary-data workflow's runner token was used to create a malicious release commit and trigger the project's release workflow, which built and signed the malicious package.
The elementary-data .pth payload executed at Python interpreter startup, harvested credentials and secrets, and exfiltrated an archive over HTTPS.
The KICS payload downloaded and used the Bun runtime to execute a JavaScript credential stealer.
Defensive Notes: Use least-privilege permissions for CI/CD workflows and runner identities.
Audit GitHub Actions workflows for user-controlled event data interpolated directly into shell commands; sanitize inputs and avoid unsafe run-block interpolation.
Pin container images to verified digests rather than tags, and apply network egress controls to CI runners.
Rotate potentially exposed credentials from a clean host, including cloud credentials, GitHub PATs, npm tokens, SSH keys, Kubernetes tokens, and secrets stored in files or developer tooling.
Treat hosts that installed elementary-data 0.23.3 or ran the identified compromised KICS, extension, GitHub Action, or Bitwarden CLI artifacts during their exposure windows as compromised.
Hunt for unexpected Bun execution, Python interpreter processes making outbound HTTPS connections at startup, GitHub commit-search API calls from CI agents, and the reported temporary artifacts and actor-branded exfiltration header.
Review CloudTrail for secretsmanager:ListSecrets, secretsmanager:GetSecretValue, and ssm:DescribeParameters from CI or data-pipeline identities that should not access those services.
Block documented C2 infrastructure when available and preserve relevant artifacts for incident response before cleanup.