FBI Warns of 'TeamPCP' Supply Chain Attack Compromising Developer Tools to Steal Cloud Secrets

The FBI has issued a formal FLASH advisory warning organizations of a massive, highly coordinated software supply chain attack orchestrated by a threat group known as TeamPCP. Instead of targeting individual companies directly, the attackers are poisoning the very tools that developers rely on to build and secure their applications.[1]

By compromising widely used utilities—including vulnerability scanners, infrastructure-as-code analyzers, and AI gateway libraries—TeamPCP has managed to infiltrate thousands of corporate environments. Once inside, the malicious code quietly extracts the keys to the kingdom: cloud access tokens, SSH keys, and Kubernetes secrets.

The scale of the campaign is unprecedented, with security researchers estimating that over 500,000 login credentials and cloud tokens have been harvested since the attacks escalated in March 2026. The compromised data spans major cloud providers, including AWS, Google Cloud Platform, and Microsoft Azure.

What makes this campaign particularly dangerous is its ability to bypass traditional security controls. Endpoint detection systems are designed to flag suspicious external processes, not to scrutinize a trusted, digitally signed developer tool that already possesses the permissions necessary to operate within a production environment.

"The pattern is consistent: go after the tools developers trust, poison the supply chain, and let the downstream damage multiply," security analysts noted following the FBI's alert. The attackers inject malicious code into legitimate software packages and push the trojanized versions through normal distribution channels.

One of the earliest major breaches in this campaign involved the open-source Trivy project, a highly popular container vulnerability scanner. In late March, TeamPCP exploited a misconfigured GitHub Actions workflow to steal CI/CD secrets, delete trusted tags, and force-push malicious binaries to the repository.[2]

The poisoned Trivy updates, which appeared entirely normal to end users, contained an infostealer capable of harvesting environment variables and cloud tokens directly from build environments. This single compromise affected an estimated 10,000 continuous integration and continuous deployment (CI/CD) workflows globally.[2]

TeamPCP did not stop there. Using the credentials stolen during the Trivy breach, the group pivoted to compromise other critical developer tools. They successfully infiltrated Checkmarx's GitHub Actions for infrastructure-as-code security scanning, modifying workflows to execute malicious code during routine pipeline runs.[2]

The attackers also targeted LiteLLM, a widely deployed proxy for routing requests across artificial intelligence model APIs. Because LiteLLM is often included as a transitive dependency in other software projects, the malicious code was pulled into countless environments without developers ever explicitly installing the package.[2]

The campaign's technical sophistication reached a new peak with the deployment of "Mini Shai-Hulud," a self-replicating software supply chain worm. This malware spreads autonomously across the npm and PyPI package registries, waiting for developers to download compromised packages before hijacking their publishing authority to infect even more repositories.

In a highly publicized wave in May 2026, the Mini Shai-Hulud worm poisoned roughly 170 packages across the npm and PyPI ecosystems in a matter of minutes. The affected packages, which included widely used libraries from TanStack, Mistral AI, and UiPath, had a combined cumulative download count exceeding 500 million.

Alarmingly, the Mini Shai-Hulud worm represented the first documented instance of npm malware shipping with valid Supply chain Levels for Software Artifacts (SLSA) Build Level 3 provenance. This development shattered the industry assumption that cryptographic provenance alone is sufficient to guarantee the safety of a software package.

TeamPCP has also demonstrated a willingness to collaborate with other cybercriminal organizations, including ransomware-as-a-service operators. Security firms warn that organizations whose credentials were stolen by TeamPCP are at an elevated risk of subsequent ransomware deployment, as the group frequently monetizes its access by selling it to affiliates.

Despite the severity of the threat, the cybersecurity community is rapidly mobilizing to neutralize TeamPCP's tactics. The FBI's FLASH alert provides organizations with the specific indicators of compromise and behavioral patterns needed to hunt for the malware within their own networks.[1]

Security teams are fundamentally rethinking how they secure CI/CD pipelines. Rather than blindly trusting signed binaries, organizations are implementing minimum package age policies, which mandate a waiting period before newly published updates can be integrated into production environments. This delay allows the broader community to scrutinize the code for anomalies.[2]

Developers are also shifting toward strict lockfile verification and dependency pinning, ensuring that build pipelines only pull exact, known-good versions of software packages rather than automatically fetching the latest updates.

Furthermore, the industry is moving toward zero-trust architecture for build environments. By restricting the network access of CI/CD runners and tightly scoping the permissions of automated workflows, organizations can prevent compromised tools from exfiltrating stolen secrets to attacker-controlled servers.[2]

The TeamPCP campaign serves as a watershed moment for software supply chain security. While the attacks have caused significant disruption, they are also forcing a necessary evolution in how the tech industry builds, verifies, and deploys code, ultimately leading to a more resilient digital ecosystem.