← Back to Attacks & Incidents

Now playing · Tape 12INCIDENT ANALYSISjun 9 2026SP 2 min

The Team PCP attack: what actually happened.

Five coordinated waves. 170+ poisoned packages with valid SLSA L3 provenance. 3,800 private GitHub repositories exfiltrated. The attack didn't break the supply chain — it used it.

The numbers

5

COORDINATED ATTACK WAVES — MAR–MAY 2026

170+

MALICIOUS PACKAGES WITH VALID SLSA L3 PROVENANCE

3,800

PRIVATE GITHUB REPOS EXFILTRATED AND LISTED FOR SALE

Wave by wave

  1. WAVE 01MAR 19–24
    INITIAL ACCESS

    The security tool attack

    Compromised release credentials used to publish malicious Aqua Trivy v0.69.4, backdoor Checkmarx KICS GitHub Actions, and insert a credential-harvesting .pth payload into LiteLLM PyPI 1.82.7–1.82.8 — triggered globally at Python startup.

    • Trivy scanner
    • KICS actions
    • LiteLLM PyPI
  2. WAVE 02MAR 27
    FOOTPRINT GROWS

    Infrastructure expansion

    Telnyx Python SDK poisoned on PyPI to extract developer and infrastructure secrets from cloud communications environments — a deliberate expansion beyond security tooling to the entire developer infrastructure layer.

    • Telnyx PyPI SDK
    • Credential extraction
  3. WAVE 03APR 22–24
    ESCALATION

    Multichannel exploitation

    Checkmarx KICS hit again with stolen tokens. @bitwarden/cli hijacked on npm. Xinference PyPI deployed to target enterprise AI inference environments directly.

    • Bitwarden CLI npm
    • Xinference PyPI
    • Docker Hub
  4. WAVE 04MAY 11–15
    SELF-PROPAGATING

    Mini Shai-Hulud worm

    GitHub Actions cache poisoning combined with OIDC token extraction from runner process memory produced 170+ malicious packages with valid SLSA Level 3 provenance — bypassing standard provenance checks entirely. Affected Mistral AI, Guardrails AI, UiPath, OpenSearch, and SAP CAP.

    • GitHub Actions cache
    • OIDC tokens
    • Valid SLSA L3
  5. WAVE 05MAY 20
    MOST SEVERE

    GitHub internal breach

    Poisoned VS Code extension compromised an employee workstation. 3,800 private internal GitHub repositories exfiltrated and listed for sale at $50,000 on underground forums — with stated intent to leak publicly if no buyer.

    • VS Code extension
    • 3,800 private repos
    • $50,000 listing

The pattern

Every wave used an official channel — PyPI, npm, Docker Hub, VS Code marketplace, GitHub Actions. The AI stack was targeted deliberately across every wave: LiteLLM, Xinference, Mistral AI, Guardrails AI. And 170+ packages carried valid SLSA Level 3 provenance, meaning standard supply chain checks passed them without issue.

THE LESSON

Provenance checks confirm where a package came from. They don't confirm what it does at runtime. The attack didn't forge credentials — it stole legitimate ones. The packages were genuinely signed. Runtime enforcement at the execution layer is the only control that operates after a dependency has already passed every pre-deployment check.

Say yes to the AI your business wants.

Book a 30-minute call. Bring your agents and your rules.

Book a demoTest your own agent free →