Product
KICS
- First Reported
- Mar 26, 2026
- Latest Reported
- Jun 2, 2026
Reported Context (4)
- TeamPCP used compromised credentials to publish malicious versions of Trivy and KICS on GitHub, along with two compromised versions of LiteLLM on PyPI (Python Package Index), as part of a broader supply chain campaign. How GitHub Actions Workflow Weaknesses Can Enable Supply Chain Attacks
- Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft TeamPCP Supply-Chain Attacks Steal Credentials Through KICS and elementary-data
- GitHub Actions compromise [4] [5], and the TeamPCP cascading campaign affecting Trivy, LiteLLM, KICS, and related ecosystems [6] [7]—demonstrate a consistent attacker model: Supply-Chain Attacks Exploit Trusted Maintainers, CI/CD Workflows and Software Tools
- Checkmarx KICS (March 23): Using compromised Checkmarx credentials, TeamPCP hijacked all 35 tags (v1 through v2.1.20) of the KICS GitHub Action, an infrastructure-as-code security scanner. Two malicious VS Code TeamPCP’s LiteLLM Supply-Chain Attack Stole Credentials and Installed a Backdoor
CVE (2)
Malware (2)
People (6)
Threat Actors (7)
MITRE ATT&CK (36)
Vendors (12)
Products (22)
Tools (7)
Industries (13)
Countries (15)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.