Cybersecurity & Privacy — 2026-03-26
TeamPCP Supply Chain Attack Compromises Checkmarx KICS, Trivy, and LiteLLM
Threat actor TeamPCP executed a coordinated supply chain attack targeting Checkmarx KICS GitHub Action, Trivy, and LiteLLM on March 23. Organizations running KICS scans in CI/CD pipelines during a four-hour window were potentially exposed to an infostealer harvesting environment variables, cloud tokens, and SSH keys. Malicious VS Code plugins were also published to OpenVSX for approximately three hours. Wiz Research attributed all three compromises to the same actor. Checkmarx advised all affected organizations to rotate credentials, access keys, and login tokens.
Analysis
The widening from Trivy (covered in the prior digest) to Checkmarx KICS and LiteLLM shows TeamPCP systematically targeting the security tooling supply chain rather than application code directly. Compromising the tools that scan for vulnerabilities inverts the trust model: organizations running security checks were unknowingly exposing their credentials.
The widening from Trivy (covered in the prior digest) to Checkmarx KICS and LiteLLM shows TeamPCP systematically targeting the security tooling supply chain rather than application code directly. Compromising the tools that scan for vulnerabilities inverts the trust model: organizations running security checks were unknowingly exposing their credentials.