TeamPCP Exploits AI Supply Chain to Steal One Terabyte of…

The TeamPCP campaign compromised GitHub Actions and PyPI packages between March and April 2026. Over 2,500 organizations potentially exposed and an estimated one terabyte of credentials stolen.

The TeamPCP campaign struck between March and April 2026, targeting widely used DevSecOps tools and AI gateways. It compromised GitHub Actions for Trivy and Checkmarx and published malicious versions of the Python package LiteLLM on PyPI. The dossier estimates one terabyte of credentials stolen, with over 434,000 CI/CD pipelines potentially exposed and more than 2,500 organizations affected by the LiteLLM incident. The novelty lies not only in the scale but in the target choice: AI gateways concentrate access tokens to multiple cloud infrastructures, turning a single compromise into an unprecedented impact multiplier compared to traditional supply chain attacks.

Key Takeaways

Between March 19 and 20, 2026, tags for trivy-action and setup-trivy were redirected to malicious commits: the dependency name remained unchanged, but the workflow executed different code.
On March 24, 2026, versions 1.82.7 and 1.82.8 of LiteLLM appeared on PyPI. LiteLLM acts as a gateway between applications and language model providers, making it a potential trove of cloud tokens and AI infrastructure secrets.
The payload mimicked normal Trivy scanner behavior: pipelines produced correct results while data was exfiltrated from SSH keys, cloud tokens, Kubernetes credentials, and .env files.
The initial compromise of Aqua Security's CI/CD environment occurred via credentials not fully revoked during a prior rotation.

The Vector: When CI/CD Becomes an Entry Point

According to the dossier, the attack originated from Aqua Security's CI/CD environment, the maker of Trivy. Attackers allegedly exploited credentials not fully revoked during a previous rotation, obtaining GitHub tokens with sufficient privileges to modify the references used by GitHub Actions. Between March 19 and 20, 2026, multiple tags for trivy-action and setup-trivy were redirected to commits containing malicious code.

The technique is insidious because it is invisible to the dependency declaration: "the dependency name remained unchanged, but the workflow executed content different from what was expected", as reported by IlSoftware.it. The malicious code actively searched for secrets available on the runner, including SSH keys, cloud tokens, Kubernetes credentials, and .env files. A portion of the code simulated normal scanner behavior, so the pipeline could produce correct results while data was exfiltrated.

Propagation: From Trivy to LiteLLM, the Economics of the AI Supply Chain

The campaign did not stop at DevSecOps tools. On March 23, 2026, Checkmarx KICS and AST GitHub Actions were hit; the following day, March 24, 2026, malicious versions 1.82.7 and 1.82.8 of LiteLLM appeared on PyPI. This package functions as a gateway between applications and language model providers, a position that makes it potentially rich in cloud tokens and AI infrastructure secrets.

The campaign expanded via stolen credentials to gain access to other repositories. The mechanism is linear: an initial compromise yields credentials, credentials yield secondary access, secondary access yields new compromises. The difference from traditional supply chains lies in the nature of the AI gateway: a single package like LiteLLM can hold tokens for multiple cloud infrastructures and language models, raising the attack's return compared to compromising a generic library.

"A supply chain attack can turn a trusted component into a collection point for credentials, API keys, and authentication tokens" — IlSoftware.it

The Scale: 434,000 Pipelines and the Limits of the Estimate

Research by CloudSEK reconstructed over 434,000 CI/CD pipelines potentially exposed and more than 2,500 organizations affected by the LiteLLM case. The estimated volume of stolen credentials is indicated as "one terabyte." Both numbers derive from a single editorial source and are not independently corroborated: the pipeline estimation methodology is not described, and it is unclear whether the terabyte refers to plaintext credentials, encrypted credentials, or aggregated data. The dossier also does not specify how many organizations were actually compromised versus those "potentially exposed."

The CloudSEK source, cited by IlSoftware.it, is not linked or independently verifiable in the available dossier. This constitutes a significant limitation: the numbers are presented as estimates from a threat intelligence firm, but the reader cannot access the original report to evaluate its methodology.

Why It Matters

The brief does not document specific remediation measures or detailed operational recommendations from the primary source. What the dossier makes clear, however, is the persistence of the problem: "removing the infected package is not enough. A credential copied during execution can remain valid after the runner is cleaned", as reported by IlSoftware.it. This dynamic makes removal of the malicious code insufficient to close the incident.

The LiteLLM case also shows how AI gateways have become high-value targets. Their architectural function — a mediating layer between applications and multiple LLM providers — makes them privilege concentrators that traditional DevSecOps tools were not. The AI supply chain is no longer an extension of the software supply chain, but an impact multiplier with its own characteristics.

The dossier does not specify the nature of the data actually exfiltrated beyond generic categories (SSH keys, cloud tokens, Kubernetes credentials, .env files). It is unclear whether the terabyte of credentials pertains only to this campaign or to aggregated TeamPCP operations. No details emerge on how attribution to the group was determined, nor whether Aqua Security has publicly confirmed the initial compromise of its CI/CD. Information on any legal responses or indexing is absent.

Questions and Answers

Which LiteLLM versions are compromised?

According to the dossier, the malicious versions published on PyPI are 1.82.7 and 1.82.8, which appeared on March 24, 2026. IlSoftware.it does not report which subsequent versions were published to replace them.

How did the evasion work in the Trivy payload?

The malicious code simulated normal scanner behavior: pipelines completed execution with apparently correct results, masking the ongoing exfiltration. This technique reduces the likelihood of detection by monitoring based on workflow failure.

Does the dossier indicate who discovered the campaign?

IlSoftware.it cites CloudSEK as the source for the estimate on exposed pipelines and organizations, but does not provide a link to the original report nor indicate whether the technical discovery of the compromise is attributable to CloudSEK or other researchers.

Sources

Information is based on the cited source and current as of publication.

Sources

Sources and references