TeamPCP Steals ~3,800 Internal GitHub Repositories Through Poisoned Trivy, LiteLLM and Nx Console Releases
The TeamPCP campaign, which started with tampered security tooling in March 2026, ended with the theft of roughly 3,800 internal GitHub repositories after a poisoned Nx Console extension compromised an employee's device. GitHub called the attackers' repository count directionally consistent with its investigation and reported no evidence that customer-owned repositories were affected, although some internal repositories held customer support excerpts. The chain began with a late-February intrusion that abused an misconfigured GitHub Actions environment and an incomplete credential rotation at Aqua Security, then spread to Trivy, LiteLLM, Checkmarx KICS and the Nx Console extension (more than 2.2 million installations). Because stolen tokens were reused to push further malicious releases, the incident is a cascading distribution problem rather than a single poisoned package. The primary advisories (GitHub, Aqua Security, GHSA entries) were not retrieved for this record, so vendor-stated CVSS scores, prerequisites and fixed versions are not confirmed here.
Detalhes técnicos
- Trivy and trivy-action: attackers compromised release automation instead of exploiting a flaw in Trivy's scanner. They published a malicious Trivy 0.69.4, redirected 76 of 77 trivy-action version tags and replaced all seven setup-trivy tags, so workflows referencing those mutable tags ran malicious code without any change to their own configuration (Blackfog researchers, as reported by the article).
- Payload: the code read secrets from the Runner.Worker process memory, which sidestepped the masking applied to workflow logs. It searched more than 50 filesystem locations for SSH keys, cloud credentials, Kubernetes tokens, Docker configurations and environment files, encrypted the results and sent them to scan.aquasecurtiy.org, a domain impersonating Aqua Security. Where GitHub permissions allowed, a fallback stored the archives in a repository named tpcp-docs.
- LiteLLM: versions 1.82.7 and 1.82.8 were compromised; 1.82.8 added a malicious .pth file that ran code at Python startup, even without importing LiteLLM.
- Nx Console: version 18.95.0 was published on May 18 with stolen extension publishing credentials. The multistage payload targeted developer secrets rather than application vulnerabilities.
- Harvesting and exfiltration: the tooling targeted GitHub, npm, AWS, HashiCorp Vault, Kubernetes and 1Password credentials, and used HTTPS, the GitHub API and DNS tunneling to move them out.
- Downstream: tokens stolen in the chain enabled attacks against Checkmarx KICS and other software distribution channels.
- Actor profile: TeamPCP appeared at the end of 2025, is financially motivated, uses Telegram as its main channel, and claims to be a rebranded group rather than a new one.
Remediação
- GitHub response: GitHub detected and contained the employee endpoint compromise on May 18, removed the malicious extension version, isolated the device and rotated critical secrets. It also announced a GitHub Enterprise Server signing key rotation, so administrators must update trusted public keys before installing future releases.
- Defender actions: identify every workflow or developer execution that ran the poisoned versions, revoke exposed credentials (a deleted package does not invalidate stolen tokens), review subsequent authentication activity, and rebuild affected runners and endpoints.
- Hardening: pin GitHub Actions to verified full commit hashes instead of mutable tags, restrict token permissions in workflows, and separate publishing credentials so one stolen token cannot distribute further releases.
Linha do tempo
-
TeamPCP Steals ~3,800 Internal GitHub Repositories Through Poisoned Trivy, LiteLLM and Nx Console Releases
ler a análise desta fonte ocultar
The TeamPCP campaign, which started with tampered security tooling in March 2026, ended with the theft of roughly 3,800 internal GitHub repositories after a poisoned Nx Console extension compromised an employee's device. GitHub called the attackers' repository count directionally consistent with its investigation and reported no evidence that customer-owned repositories were affected, although some internal repositories held customer support excerpts. The chain began with a late-February intrusion that abused an misconfigured GitHub Actions environment and an incomplete credential rotation at Aqua Security, then spread to Trivy, LiteLLM, Checkmarx KICS and the Nx Console extension (more than 2.2 million installations). Because stolen tokens were reused to push further malicious releases, the incident is a cascading distribution problem rather than a single poisoned package. The primary advisories (GitHub, Aqua Security, GHSA entries) were not retrieved for this record, so vendor-stated CVSS scores, prerequisites and fixed versions are not confirmed here.
Technical Details
- Trivy and trivy-action: attackers compromised release automation instead of exploiting a flaw in Trivy's scanner. They published a malicious Trivy 0.69.4, redirected 76 of 77 trivy-action version tags and replaced all seven setup-trivy tags, so workflows referencing those mutable tags ran malicious code without any change to their own configuration (Blackfog researchers, as reported by the article).
- Payload: the code read secrets from the Runner.Worker process memory, which sidestepped the masking applied to workflow logs. It searched more than 50 filesystem locations for SSH keys, cloud credentials, Kubernetes tokens, Docker configurations and environment files, encrypted the results and sent them to scan.aquasecurtiy.org, a domain impersonating Aqua Security. Where GitHub permissions allowed, a fallback stored the archives in a repository named tpcp-docs.
- LiteLLM: versions 1.82.7 and 1.82.8 were compromised; 1.82.8 added a malicious .pth file that ran code at Python startup, even without importing LiteLLM.
- Nx Console: version 18.95.0 was published on May 18 with stolen extension publishing credentials. The multistage payload targeted developer secrets rather than application vulnerabilities.
- Harvesting and exfiltration: the tooling targeted GitHub, npm, AWS, HashiCorp Vault, Kubernetes and 1Password credentials, and used HTTPS, the GitHub API and DNS tunneling to move them out.
- Downstream: tokens stolen in the chain enabled attacks against Checkmarx KICS and other software distribution channels.
- Actor profile: TeamPCP appeared at the end of 2025, is financially motivated, uses Telegram as its main channel, and claims to be a rebranded group rather than a new one.
Remediation
- GitHub response: GitHub detected and contained the employee endpoint compromise on May 18, removed the malicious extension version, isolated the device and rotated critical secrets. It also announced a GitHub Enterprise Server signing key rotation, so administrators must update trusted public keys before installing future releases.
- Defender actions: identify every workflow or developer execution that ran the poisoned versions, revoke exposed credentials (a deleted package does not invalidate stolen tokens), review subsequent authentication activity, and rebuild affected runners and endpoints.
- Hardening: pin GitHub Actions to verified full commit hashes instead of mutable tags, restrict token permissions in workflows, and separate publishing credentials so one stolen token cannot distribute further releases.