TeamPCP Supply Chain Campaign: LiteLLM PyPI Compromise, CanisterWorm npm Propagation, and Multi-Ecosystem Attack (CVE-2026-33634)

TeamPCP Supply Chain Campaign (TL-2026-0279), also tracked as TeamPCP Campaign, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-03-24. It is attributed to TeamPCP with high confidence, affects BerriAI LiteLLM, references 1 CVE (CVE-2026-33634), maps to 29 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 30 indicators of compromise.

Key facts for TL-2026-0279

Threat ID
TL-2026-0279
Also known as
TeamPCP Campaign, CanisterWorm, Operation TPCP
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
MONITORING
Category
SUPPLY_CHAIN
First published
2026-03-24
Last reviewed
2026-03-24
Attribution
TeamPCP
Attribution confidence
HIGH
Motivation
DESTRUCTION
Target sectors
technology, financial, government, healthcare, enterprise, cloud-infrastructure, devops, artificial-intelligence
Target regions
Global, North America, Europe, Middle East
Detection rules
9
Indicators of compromise
30

Malware and tooling in TeamPCP Supply Chain Campaign

Malware and tooling: CanisterWorm, ICP Canister Dead Drop

A coordinated five-day supply chain campaign by TeamPCP spanning PyPI, npm, Docker Hub, GitHub Actions, and OpenVSX. Beginning with the compromise of Aqua Security's Trivy scanner on March 19, 2026, the campaign escalated to backdoor LiteLLM versions 1.82.7-1.82.8 on PyPI, deploy the self-propagating CanisterWorm across 66+ npm packages, and launch destructive Kubernetes wipers targeting Iranian systems. Payloads harvest credentials using AES-256/RSA-4096 hybrid encryption, establish systemd persistence, and spread laterally in Kubernetes environments via privileged pod deployment.

How TeamPCP Supply Chain Campaign works

TeamPCP conducted one of the most consequential supply chain campaigns of 2026, compromising five software ecosystems over five days (March 19-24, 2026). The campaign represents a significant escalation in supply chain attack sophistication, combining credential theft, worm propagation, Kubernetes cluster compromise, and targeted destruction.

INITIAL VECTOR — TRIVY COMPROMISE (March 19): The attack began when TeamPCP exploited a compromised "Argon-DevOps-Mgt" service account token that bridged two Aqua Security GitHub organizations. At 17:43:37 UTC on March 19, the attackers force-pushed malicious commits to 76 of 77 aquasecurity/trivy-action tags and all 7 aquasecurity/setup-trivy tags. Simultaneously, Trivy v0.69.4 was published with embedded credential-stealing binaries across all platform targets (Linux, Windows, macOS, FreeBSD, ARM). The malicious Trivy binary beaconed to scan.aquasecurtiy[.]org (typosquat resolving to 45.148.10.212) and the ICP canister tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0[.]io — the first publicly documented abuse of an Internet Computer Protocol canister as a C2 dead drop resolver.

NPM CANISTERWORM PROPAGATION (March 20-22): Using credentials stolen from CI/CD environments via the Trivy compromise, TeamPCP deployed CanisterWorm — a self-propagating npm worm that spread across 141 malicious package artifacts spanning 66+ unique packages. Major affected scopes included @EmilGroup (28 packages), @opengov (16 packages), @teale.io, @airtm, @virtahealth, and @pypestream. The worm used the ICP canister as its command-and-control resolver and propagated by publishing new malicious versions of packages using stolen npm automation tokens.

KUBERNETES PAYLOADS AND GITHUB DEFACEMENT (March 22): On March 22, between 20:31:07 and 20:32:26 UTC, TeamPCP executed a scripted defacement of all 44 repositories in the aquasec-com GitHub organization, renaming them with "tpcp-docs-" prefixes and setting descriptions to "TeamPCP Owns Aqua Security." Concurrently, Kubernetes-specific payloads were deployed that created privileged DaemonSets across cluster nodes. On Iranian systems, the "host-provisioner-iran" DaemonSet mounted the host root filesystem and ran a container named "kamikaze" that executed rm -rf / --no-preserve-root. Non-Iranian targets received the "host-provisioner-std" DaemonSet with persistent backdoor installation.

CHECKMARX AND OPENVSX COMPROMISE (March 23): The campaign expanded to Checkmarx GitHub Actions (kics-github-action v1.1, ast-github-action v2.3.28) and OpenVSX extensions (ast-results 2.53.0, cx-dev-assist 1.7.0), using the same credential theft methodology from the initial Trivy breach.

LITELLM PYPI COMPROMISE (March 24): The final escalation targeted LiteLLM, a widely-used AI proxy library present in 36% of cloud environments. At approximately 8:30 UTC, versions 1.82.7 and 1.82.8 were published to PyPI using credentials stolen via compromised Trivy in LiteLLM's CI/CD pipeline. Version 1.82.7 injected a double base64-encoded payload into litellm/proxy/proxy_server.py, executing when litellm --proxy was invoked. Version 1.82.8 added litellm_init.pth, abusing Python's .pth file mechanism to execute the payload on any Python interpreter startup system-wide. Both versions quarantined by PyPI at 11:25 UTC.

PAYLOAD KILL CHAIN: 1. COLLECT: Sweeps environment variables, SSH keys, cloud credentials (AWS/GCP/Azure), Kubernetes configs and service account tokens, Docker configs, CI/CD secrets, database credentials, cryptocurrency wallets, .env files, .npmrc tokens, and shell history. 2. ENCRYPT: Data encrypted with AES-256 session key; session key encrypted with embedded RSA-4096 public key. Packaged as tpcp.tar.gz. 3. EXFILTRATE: Primary endpoint models.litellm[.]cloud (HTTP header X-Filename: tpcp.tar.gz). Fallback creates public tpcp-docs GitHub repository if GitHub token available. 4. PERSIST: Drops ~/.config/sysmon/sysmon.py and installs ~/.config/systemd/user/sysmon.service polling every 50 minutes. 5. C2 BEACON: Contacts checkmarx[.]zone/raw for follow-on payloads, downloads to /tmp/pglog for execution. 6. KUBERNETES SPREAD: If Kubernetes service account tokens available, creates privileged node-setup-* pods to compromise additional cluster nodes.

MITRE ATT&CK techniques used in TL-2026-0279

collection

T1005 Data from Local System; T1560 Archive Collected Data

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1078 Valid Accounts; T1140 Deobfuscate/Decode Files or Information

exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

execution

T1059 Command and Scripting Interpreter; T1204 User Execution; T1610 Deploy Container

command-and-control

T1071 Application Layer Protocol; T1102 Web Service; T1572 Protocol Tunneling

discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1614 System Location Discovery

initial-access

T1195 Supply Chain Compromise

impact

T1485 Data Destruction; T1491 Defacement

credential-access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

persistence

T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

privilege-escalation

T1546 Event Triggered Execution; T1611 Escape to Host

resource-development

T1583 Acquire Infrastructure; T1586 Compromise Accounts

Affected products and versions in TeamPCP Supply Chain Campaign

  • BerriAI — LiteLLM
    Vulnerable versions: 1.82.7; 1.82.8
    Fixed in: 1.82.6; 1.82.9+
  • Aqua Security — Trivy
    Vulnerable versions: 0.69.4; 0.69.5; 0.69.6
    Fixed in: 0.69.2; 0.69.3
  • Aqua Security — trivy-action (GitHub Action)
    Vulnerable versions: 0.0.1-0.34.2 (76 tags)
    Fixed in: 0.35.0
  • Aqua Security — setup-trivy (GitHub Action)
    Vulnerable versions: 0.2.0-0.2.6 (original)
    Fixed in: 0.2.6 (recreated)
  • Checkmarx — kics-github-action
    Vulnerable versions: v1.1
  • Checkmarx — ast-github-action
    Vulnerable versions: v2.3.28
  • Multiple (npm) — npm packages (@emilgroup, @opengov, @teale.io, @airtm, @virtahealth, @pypestream scopes)
    Vulnerable versions: 141+ artifacts across 66+ packages
  • Checkmarx — OpenVSX Extensions (ast-results, cx-dev-assist)
    Vulnerable versions: ast-results 2.53.0; cx-dev-assist 1.7.0

Remediation for TeamPCP Supply Chain Campaign

Patches

  • Upgrade LiteLLM to clean version (1.82.6 or later patched release)
  • Use Trivy 0.69.2 or 0.69.3 (safe versions)
  • Pin trivy-action to 0.35.0 (only safe tag)
  • Pin setup-trivy to recreated safe 0.2.6 tag
  • Remove all npm packages from compromised scopes and verify integrity

Immediate actions

  • Identify every host, container, CI job, and developer workstation running LiteLLM 1.82.7 or 1.82.8
  • Identify systems that executed Trivy v0.69.4, 0.69.5, or 0.69.6 or used compromised GitHub Actions versions
  • Block egress to models.litellm.cloud, checkmarx.zone, aquasecurtiy.org, scan.aquasecurtiy.org, and all identified Cloudflare tunnel domains
  • Block egress to 45.148.10.212
  • Quarantine all affected systems — do not treat package reversion as complete remediation
  • Check for persistence artifacts: litellm_init.pth, ~/.config/sysmon/sysmon.py, ~/.config/systemd/user/sysmon.service, /tmp/pglog, /tmp/.pg_state
  • In Kubernetes: audit logs for privileged pod creation, node-setup-* pods, unusual secret access, DaemonSets named host-provisioner-iran or host-provisioner-std
  • Verify npm packages against known compromised versions across all affected scopes

Workarounds

  • If LiteLLM cannot be immediately removed, block all outbound traffic from affected hosts
  • Disable Python .pth file processing in hardened environments
  • Restrict Kubernetes RBAC to prevent privileged pod creation
  • Use hash-pinned container images instead of tag-based references

Longer-term hardening

  • Rebuild critical systems from known-good images and pinned dependencies
  • Implement supply chain firewall (e.g., Datadog SCFW) to block known malicious packages at install time
  • Pin all CI/CD dependencies to immutable digests rather than mutable tags
  • Implement network segmentation to limit blast radius of credential theft
  • Deploy behavioral detection for .pth file abuse, systemd service creation, and anomalous container creation in Kubernetes
  • Establish dependency provenance verification for all package ecosystems
  • Implement runtime protection to detect and block credential harvesting from environment variables and filesystem

CVEs associated with TeamPCP Supply Chain Campaign

CVE-2026-33634

Weaknesses (CWE) in TeamPCP Supply Chain Campaign

CWE-506, CWE-502, CWE-798, CWE-912

Timeline of TeamPCP Supply Chain Campaign

  • TeamPCP compromises Aqua Security Trivy via stolen Argon-DevOps-Mgt service account token. Trivy v0.69.4 published with embedded credential stealer at 17:43:37 UTC. 76 of 77 trivy-action tags and all 7 setup-trivy tags force-pushed with malicious commits.
  • CanisterWorm self-propagating npm malware begins spreading using credentials stolen from CI/CD environments. Initial infections across @EmilGroup scope (28 packages) and @opengov scope (16 packages).
  • Kubernetes-specific destructive payloads deployed including Iranian-targeting wiper (kamikaze container). Trivy v0.69.5 and v0.69.6 pushed without GitHub releases. All 44 aquasec-com GitHub repositories defaced with tpcp-docs- prefix between 20:31:07-20:32:26 UTC.
  • Campaign expands to Checkmarx GitHub Actions (kics-github-action v1.1, ast-github-action v2.3.28) and OpenVSX extensions (ast-results 2.53.0, cx-dev-assist 1.7.0) using identical credential theft methodology.
  • Full campaign scope assessed: 5 ecosystems (PyPI, npm, Docker Hub, GitHub Actions, OpenVSX), 141+ malicious npm artifacts across 66+ packages, LiteLLM present in 36% of cloud environments. CanisterWorm represents first documented ICP canister abuse for C2.
  • Datadog Security Labs, Wiz, Snyk, and multiple security vendors publish detailed analysis of the full TeamPCP campaign. CVE-2026-33634 assigned for Trivy compromise. PYSEC-2026-2 and GHSA-69fq-xp46-6x23 advisories published.
  • PyPI quarantines malicious LiteLLM versions 1.82.7 and 1.82.8 at 11:25 UTC, approximately 3 hours after publication.
  • LiteLLM versions 1.82.7 and 1.82.8 published to PyPI at approximately 8:30 UTC with credential-stealing payloads. v1.82.7 injects payload in proxy_server.py; v1.82.8 adds litellm_init.pth for system-wide Python execution persistence.
  • As of 2026-05-29, the specific March 2026 incidents are contained (LiteLLM 1.82.7-1.82.8 quarantined on PyPI within hours, CanisterWorm npm packages pulled, Trivy tags restored), but actor TeamPCP (UNC6780) remains highly active and uncaught. Sibling reporting through May 2026 shows continued waves (TanStack/Mistral, a 3,800-repo GitHub breach, and the worm open-sourced), so the tooling and playbook persist.

Sources cited for TeamPCP Supply Chain Campaign

Threats related to TeamPCP Supply Chain Campaign

Detection coverage for TL-2026-0279

As of 2026-03-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0279 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats