Fetching from the wire…
01
02
03
04
05
06
07
08
Top 5 · 2026-03-27 · source-backed
A security scanner. The tool your team trusts to find vulnerabilities. That was the entry point.
The TeamPCP campaign compromised Aqua Security's Trivy scanner (a GitHub Action used in CI/CD pipelines), then used that foothold to backdoor LiteLLM's CI/CD pipeline, then pivoted to Checkmarx KICS. The attack chain is almost elegant in how it exploits trust hierarchies: developers pin their application dependencies but treat security scanning tools as implicitly trusted. The attackers went after exactly that assumption.
On March 19, attacker "TeamPCP" force-pushed 75 of 76 tags on the trivy-action GitHub Action with malicious binaries that exfiltrated AWS, GCP, and Azure credentials, SSH keys, and Kubernetes tokens from approximately 10,000 GitHub workflows. This was the second compromise in March. The first happened March 1, and the root cause was incomplete credential rotation after that first incident. They didn't rotate everything. The attackers came back through the gap.
Callum McMahon published a minute-by-minute transcript (highlighted by Simon Willison) of using Claude to analyze the backdoored LiteLLM package in real time during the incident, tracing the base64-encoded payload and identifying exfiltration targets. The irony of using an AI coding tool to analyze a supply chain attack that was itself enabled by security tooling isn't lost on me.
A Datadog DevSecOps report revealed that 71% of organizations never pin GitHub Actions to commit hashes. That means nearly three-quarters of CI/CD pipelines are vulnerable to exactly this type of tag-mutation attack right now.
GitHub responded. Their 2026 Actions security roadmap introduces a new dependencies: section in workflow YAML that locks all direct and transitive dependencies by commit SHA, similar to how go.mod and go.sum work. It's the right architectural response. But it's not shipped yet.
For builders: do this today. Pin every GitHub Action in your workflows to a full commit SHA, not a version tag. Replace uses: aquasecurity/[redacted] with uses: aquasecurity/trivy-action@<full-sha>. It takes 20 minutes and it closes the exact attack vector that hit 10,000 pipelines this month. If you're using MCP servers, CI/CD tools, or coding agents that install dependencies, treat every dependency as untrusted code, because after this week, that's exactly what it is.
Each link below shares sources, entities, or timing with this story.
TeamPCP criticizes LiteLLM / Shared entities / Same source / Shared topic / What happened next
Linked by a graph relationship (TeamPCP criticizes LiteLLM); both cover Aqua Security, AWS, Azure, GCP; cite the same source (10,000 GitHub workflows).
TeamPCP criticizes LiteLLM / Shared entities / Same source / Shared topic / Earlier coverage
Linked by a graph relationship (TeamPCP criticizes LiteLLM); both cover Aqua Security, AWS, Azure, GCP; cite the same source (TeamPCP campaign).
DSPy uses LiteLLM / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (DSPy uses LiteLLM); both cover GitHub Actions, LiteLLM, March, MCP; reported by the same outlet (simonwillison.net).
TeamPCP criticizes LiteLLM / Shared entities / Shared topic / What happened next
Linked by a graph relationship (TeamPCP criticizes LiteLLM); both cover AWS, Azure, GitHub, LiteLLM; overlapping topics (attack, chain).
Linked by a graph relationship (TeamPCP criticizes LiteLLM); both cover AWS, GCP, GitHub, GitHub Action; overlapping topics (action, attack, attacker, chain).
Trivy criticizes LiteLLM / Shared entities / What happened next
Linked by a graph relationship (Trivy criticizes LiteLLM); both cover AWS, Azure, GCP, GitHub; picks up the AWS thread on 2026-08-13.
Microsoft uses AWS / Shared entities / Same source domain / Shared topic / What happened next
Linked by a graph relationship (Microsoft uses AWS); both cover Actions, GitHub, GitHub Actions, LiteLLM; reported by the same outlet (github.blog).
Trivy criticizes LiteLLM / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Trivy criticizes LiteLLM); both cover GitHub Actions, LiteLLM, SSH, Trivy; overlapping topics (action, attack, attacker, chain, dependency).