TeamPCP’s March 2026 Campaign Chained Trivy Compromise Into Multiple Supply-Chain Attacks

Mar 26, 2026 · Original article ↗

Summary

A retrospective traces TeamPCP’s March 2026 supply-chain campaign from retained Trivy credentials into Aqua, npm, LiteLLM, Checkmarx, OpenVSX and Telnyx, detailing credential theft, payloads and defenses.

Key points

The report traces the campaign to a February Trivy workflow compromise that exposed a personal access token; incomplete credential rotation allegedly allowed access to persist for 20 days.
On March 19, attackers poisoned Trivy releases and GitHub Actions tags, using compromised CI runners to collect secrets and credentials and exfiltrate them.
Harvested credentials enabled further compromises across Aqua Security, npm packages, LiteLLM, Checkmarx Actions and OpenVSX extensions, and Telnyx PyPI releases.
CanisterWorm spread through npm packages; the report also details malicious LiteLLM and Telnyx versions that stole credentials, with Telnyx payloads delivered in WAV files.
A geotargeted payload reportedly wiped systems in Iran, while non-Iranian systems could receive a persistent backdoor. The report says the campaign’s destructive component remains unexplained.
The article recommends pinning GitHub Actions to commit SHAs, limiting and rotating credentials, separating CI scanning and publishing permissions, and monitoring runner behavior and outbound traffic.

Article Details

Attack Vectors: A pull_request_target workflow executed code from a fork with access to repository secrets; a curl-to-bash payload extracted a Personal Access Token from process memory.
Credentials retained after an incomplete rotation were reused to push malicious Trivy tags and workflows and to compromise additional Aqua Security projects.
Compromised CI runners exposed npm and PyPI publishing tokens, enabling malicious package releases and propagation to downstream users.
Stolen service-account credentials with cross-organization administrative access were used to deface Aqua Security's internal GitHub repositories.
Malicious GitHub Actions and OpenVSX extensions harvested CI runner secrets and attempted to exfiltrate them to attacker infrastructure or repositories in victims' own GitHub accounts.
Malicious LiteLLM and Telnyx packages executed payloads on import; Telnyx payloads used WAV files to deliver second-stage payloads through audio steganography.
A geotargeted payload used Tehran timezone or Iranian locale indicators to select destructive behavior, including Kubernetes DaemonSet deployment and filesystem wiping.
Defensive Notes: Audit CI/CD workflows for pull_request_target configurations that run fork code with access to repository secrets.
Use short-lived OIDC credentials where possible and revoke credentials atomically across all systems after a compromise.
Pin GitHub Actions to full commit SHAs and verify signatures on security-critical workflow commits.
Use least-privilege, narrowly scoped service-account and package-publishing credentials; separate CI scanning credentials from deployment credentials.
Monitor CI runners for unexpected system calls, outbound connections to newly registered domains or IPs, and suspicious package publications.
Monitor for unexpected repository creation and .pth file creation, and inspect Python environments for the reported malicious package versions.
Rotate credentials accessible to environments where the affected packages or actions ran; users were advised to downgrade Telnyx to 4.87.0.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`checkmarx[.]zone`	C2 and second-stage payload domain used in the Checkmarx phase.
DOMAIN	`models[.]litellm[.]cloud`	Listed in the article as a C2 domain for exfiltration during the LiteLLM phase.
DOMAIN	`plug-tab-protective-relay[.]trycloudflare[.]com`	Cloudflare Tunnel subdomain used as an additional exfiltration C2 during the Trivy phase.
DOMAIN	`recv[.]hackmoltrepeat[.]com`	Exfiltration destination for the Personal Access Token stolen during the Trivy pull request workflow attack.
DOMAIN	`scan[.]aquasecurtiy[.]org`	Typosquatted exfiltration domain used to receive stolen data from compromised CI runners.
DOMAIN	`tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io`	ICP Canister dead-drop hostname used for CanisterWorm C2 and dynamic payload delivery.
IPV4	`45[.]148[.]10[.]212`	IP address listed as C2 infrastructure for the Trivy campaign.
IPV4	`83[.]142[.]209[.]203`	C2 and exfiltration endpoint used by the malicious Telnyx package to deliver WAV payloads and receive stolen data.