TLDR Tech / InfoSec
TeamPCP Supply Chain Campaign: A March 2026 Retrospective
TeamPCP ran a six-phase supply chain attack across five vendor ecosystems in roughly five days. It started with a single Aqua Security PAT stolen via a malicious PR against Trivy's CI pipeline in February — credentials that were never fully revoked. That one token unlocked Trivy, Aqua's internal GitHub org, npm (64+ packages via a self-propagating worm using ICP canisters as C2), LiteLLM's PyPI package, Checkmarx GitHub Actions, and Telnyx. The Telnyx phase hid payloads inside WAV audio files using steganography and meanwhile, a parallel payload wiped filesystems on Iranian infrastructure.
Read the full story