Security tools turned into credential stealers in a supply-chain campaign
August, 2026 (March to August 2026)
A campaign that Microsoft attributes to a group called TeamPCP compromised developer and security tooling. Attackers hijacked the release pipeline of the Trivy scanner, then reached Checkmarx KICS and LiteLLM. On April 22 a malicious Bitwarden CLI package (version 2026.4.0) was live on npm for 93 minutes, built to steal developer credentials such as GitHub tokens and cloud keys. Bitwarden said vault data and production systems were not affected. In August, CloudSEK published a lookup of thousands of potentially affected organizations. In October a separate compromise hit LiteLLM again (see its own entry); none of the sources reviewed link that one to TeamPCP.
Why it matters
Scanners and command-line tools run inside build systems where secrets are available. In the Trivy case, 76 of 77 tags of its GitHub Action were repointed, so anyone referencing a tag by name pulled the malicious code.
What defenders can take from it
- Pin GitHub Actions and packages to exact versions or commit hashes instead of movable tags.
- If you ran an affected version, rotate every secret that build could see.
- Give build jobs the minimum secrets they need.