March 2026 Supply Chain Attack Summary

During March 2026 alone, an unprecedented wave of 5+ supply chain attacks occurred, targeting widely-used open-source projects including Trivy and axios. This document serves as a consolidated reference.

Table of Contents

1. Trivy
2. Checkmarx-KICS
3. LiteLLM
4. Telnyx
5. Axios
6. Summary

---

1. Trivy

Targets

• trivy
• trivy-action
• setup-trivy

Attacker

• TeamPCP (also known as DeadCatx3, PCPcat, ShellForce, CipherForce)

How the Attack Unfolded

Origin: Late February Token Theft

• An autonomous bot named hackerbot-claw exploited a pull_request_target workflow misconfiguration in Trivy's CI/CD pipeline to steal a GitHub Personal Access Token (PAT).
• On March 1, Aqua Security disclosed the incident and performed credential rotation, but the attacker continued operations, suggesting incomplete coverage during the process.

trivy

• Compromised the aqua-bot service account using the stolen token, then created imposter commits spoofing legitimate maintainers (DmitriyLewen, rauchg)
• Pushed a commit (#1885610c) that replaced a composite action with a fake checkout commit (#70379aad) containing a Go source downloader
• Released as v0.69.4 → malicious binary distributed across all channels: GitHub Releases, GHCR, Docker Hub, ECR Public, deb/rpm repos
• On 3/22, additionally pushed v0.69.5, v0.69.6, and latest images to Docker Hub using separately stolen Docker Hub credentials (~10 hours of additional exposure)
• When executed, the malicious binary installed a persistence dropper at ~/.config/systemd/user/sysmon.py, polling an ICP blockchain canister every 50 minutes as a decentralized C2

trivy-action

• Exploited the stolen token to force-push 75 out of 76 tags (all except v0.35.0) to malicious commits
• Payload executed before the legitimate Trivy scan → workflows appeared to complete normally
• "TeamPCP Cloud stealer" dumped Runner.Worker process memory, harvested SSH/cloud/K8s secrets, encrypted with AES-256+RSA-4096, and exfiltrated to a remote server
• Fallback mechanism: created a tpcp-docs repository in the victim's GitHub account for exfiltration

Commits

• #ddb9da4
• #a9bc513
• etc...

setup-trivy

• Same pattern as trivy-action, all 7 tags force-pushed

Commits

• 8afa9b9

Additional Damage

• Used the aqua-bot account to push malicious workflows to tfsec and traceeshark repos, stealing GPG keys, Docker Hub, Twitter, and Slack credentials
• Used a stolen Argon-DevOps-Mgt token to deface all 44 repositories in the aquasec-com GitHub org (renamed with tpcp-docs- prefix, exposing proprietary source code)
• Used stolen npm tokens to deploy CanisterWorm worm → 66+ npm packages infected, using an ICP blockchain canister as C2 (immune to conventional takedowns)

Key Takeaways

• The entire campaign originated from a single stolen token
• Trivy binary was compromised via a malicious download from https://scan.aquasecurtiy[.]org/static during the GitHub Actions build process
• trivy-action and setup-trivy executed base64-encoded malware to harvest environment variables, public keys, and secrets from GitHub Actions runners
  • ⇒ Every project using Trivy became a potential vector for cascading 2nd and 3rd order compromises (LiteLLM, Telnyx, CanisterWorm, etc.)

Aqua Security Response

• Downgraded Trivy and removed the v0.69.4 tag
  • Emergency downgrade via brew and Docker
• trivy-action, setup-trivy
  • Republished affected tags with v prefix
  • Added commit SHA pinning support

Refs

• https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23
• https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/
• https://thehackernews.com/2026/03/trivy-security-scanner-github-actions.html
• https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release
• https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack
• https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/
• https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise (CanisterWorm)

---

2. Checkmarx-KICS

Targets

• https://github.com/Checkmarx/kics-github-action
• https://github.com/Checkmarx/ast-github-action (v2.3.28 confirmed compromised)
• OpenVSX extensions: ast-results v2.53.0, cx-dev-assist v1.7.0

Attacker

• TeamPCP

How the Attack Unfolded

• Same tag force-push pattern as trivy-action
• All 35 tags in kics-github-action hijacked
• Force-pushed to commit #8e20c7a
• Used checkmarx[.]zone (typosquat domain) as C2
• Fallback: created docs-tpcp repository using victim's GITHUB_TOKEN if C2 failed (same pattern as Trivy)
• Injected malicious code into Checkmarx OpenVSX extensions → targeting VS Code local environments

Open Questions

• Unlike Trivy, the account used for this attack was elit-cx, who had not contributed to the repo since 2021
  • It remains unclear when this account's token or credentials were originally compromised
  • The fact that such a long-inactive contributor still had push permissions raises questions about Checkmarx's access management practices

Checkmarx Response

• Added commit SHA pinning support PR#153
• Removed malicious OpenVSX extensions

Refs

• Checkmarx/kics-github-action#152
• https://www.sysdig.com/blog/teampcp-expands-supply-chain-compromise-spreads-from-trivy-to-checkmarx-github-actions

---

3. LiteLLM

Target

https://github.com/BerriAI/litellm

Attacker

• TeamPCP

How the Attack Unfolded

1. PyPI publishing token stolen as cascading damage from the Trivy compromise
   • LiteLLM's CI/CD pipeline used Trivy without version pinning → the compromised trivy-action exfiltrated the PYPI_PUBLISH token
   • CEO (Krish Dholakia)'s GitHub account was also compromised (automated defacement on 3/23–24)
2. Credential harvesting and Kubernetes malware deployment (1–2 rounds of base64 decoding)
   • v1.82.8 abused Python's .pth file mechanism (litellm_init.pth) → executes automatically on every Python process startup, even without importing LiteLLM
3. Directly uploaded litellm 1.82.7 and 1.82.8 to PyPI (bypassing normal CI/CD)
4. Exfiltrated encrypted data to models.litellm[.]cloud (not an official domain)
5. Flooded GitHub issue #24512 with 88 bot comments from 73 compromised accounts within 102 seconds to dilute discussion, then closed the issue as "not planned"

Impact

• Exposed on PyPI for ~40 minutes (10:39 UTC until quarantine)
• ~3.4 million downloads per day
• CVE-2026-33634 assigned (CVSS4B: 9.4)
• Users of the official LiteLLM Proxy Docker image were unaffected due to pinned dependencies

BerriAI Response

• Pulled PyPI 1.82.7 and 1.82.8 (rapid quarantine by PyPI security team)
• Suspended all releases pending full supply chain review
• Released v1.83.0 via a new hardened CI/CD v2 pipeline

Refs

• BerriAI/litellm#24512
• https://docs.litellm.ai/blog/security-update-march-2026
• https://thehackernews.com/2026/03/teampcp-backdoors-litellm-versions.html
• https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/

---

4. Telnyx

Target

https://github.com/team-telnyx/telnyx-python

Attacker

• TeamPCP

How the Attack Unfolded

1. PyPI token stolen as cascading damage from the Trivy compromise (likely harvested from LiteLLM environments)
2. Credential harvesting and Kubernetes malware deployment
   • WAV steganography: malicious payload hidden within WAV file audio frame data
   • 3-stage runtime attack chain: audio steganography delivery → in-memory data harvester execution → encrypted exfiltration
3. Directly uploaded telnyx 4.87.1 and 4.87.2 to PyPI
4. Malicious code injected into telnyx/_client.py, auto-executing on package import
5. C2: 83[.]142.209.203
6. Linux/macOS: no persistence — operates in temp directory, auto-deletes after execution (evasion)
7. Windows: drops msbuild.exe in Startup folder

Impact

• Exposed from 3/27 03:51 to 10:13 UTC (~6.5 hours)
• ~34,000 weekly downloads
• Telnyx platform, APIs, and infrastructure were unaffected (limited to PyPI distribution channel)

Telnyx Response

• Removed malicious releases, PyPI quarantined

Refs

• https://github.com/team-telnyx/telnyx-python/security/advisories/GHSA-955r-262c-33jc
• https://telnyx.com/resources/telnyx-python-sdk-supply-chain-security-notice-march-2026
• https://thehackernews.com/2026/03/teampcp-pushes-malicious-telnyx.html

---

5. Axios

Targets

https://www.npmjs.com/package/axios

Attacker

• UNC1069 (attributed by Google GTIG, North Korea-nexus threat actor)
• Microsoft tracking name: Sapphire Sleet (= BlueNoroff subgroup)
• Active since at least 2018, financially motivated (cryptocurrency theft)
• Entirely separate from the TeamPCP campaign

How the Attack Unfolded

1. Compromised jasonsaayman's npm account and changed the email to an attacker-controlled address (ifstap@proton.me)
   • Used a long-lived access token to publish directly via npm CLI (bypassing GitHub Actions OIDC workflow)
   • OIDC Trusted Publishing was configured, but the publish workflow also passed NPM_TOKEN as an environment variable → when both are present, npm uses the token, effectively nullifying OIDC
2. Pre-published plain-crypto-js 4.2.0 as a phantom dependency
3. Added malicious code in plain-crypto-js 4.2.1
4. Published axios 1.14.1 (tagged latest) and 0.30.4 (tagged legacy) with the malicious dependency
   • 3/31 00:21–03:20 UTC (~3 hour window, timed for Sunday-to-Monday overnight)

Malicious Payload

• postinstall hook auto-executes the SILKBELL dropper (setup.js)
• Detects OS and deploys platform-specific WAVESHAPER.V2 backdoor (macOS: C++, Windows: PowerShell, Linux: Python)
• C2 traffic mimics packages.npm.org for SIEM evasion (this domain belongs to the National Association of Pastoral Musicians, not the npm registry)
• Self-deletes after single execution

Impact

• Axios has ~100 million weekly downloads, present in ~80% of cloud/code environments (Wiz estimate)
• ~3% of the userbase downloaded during the exposure window
• Huntress observed at least 135 endpoints contacting attacker C2
• depup

npm & axios Response

• plain-crypto-js blocked from installation
• Malicious releases removed
• Compromised account disabled

Refs

• axios/axios#10604
• https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package
• https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/
• https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
• https://www.huntress.com/blog/supply-chain-compromise-axios-npm-package

---

6. Summary

Timeline

Date	Event
Late Feb	hackerbot-claw bot exploits Trivy's pull_request_target workflow, steals PAT
3/1	Aqua Security discloses incident, performs credential rotation (residual access remained)
3/19 17:43 UTC	TeamPCP: force-pushes 76 trivy-action tags + 7 setup-trivy tags, releases malicious trivy v0.69.4
3/19 20:38 UTC	Trivy team detects and removes malicious artifacts
3/20 20:45 UTC	CanisterWorm npm worm begins propagating (66+ packages)
3/22	Malicious trivy v0.69.5/6/latest pushed to Docker Hub; aquasec-com org 44 repos defaced
3/23	Checkmarx KICS/AST GitHub Action tags hijacked, OpenVSX extensions infected
3/24 10:39 UTC	LiteLLM 1.82.7 & 1.82.8 malicious upload to PyPI (~40 min exposure)
3/27 03:51 UTC	Telnyx 4.87.1 & 4.87.2 malicious upload to PyPI (~6.5 hr exposure)
3/31 00:21 UTC	Axios 1.14.1 & 0.30.4 malicious upload to npm (~3 hr exposure) — separate attacker (UNC1069, North Korea)

Attacker Classification

TeamPCP (#1–4)

• Aliases: DeadCatx3, PCPcat, ShellForce, CipherForce
• Active since 2024; built automated supply chain attack capabilities with CanisterWorm in late 2025
• Cascaded from a single stolen credential across 5 ecosystems: GitHub Actions → Docker Hub → npm → OpenVSX → PyPI

UNC1069 / Sapphire Sleet (#5)

• North Korea-nexus, active since 2018, financially motivated (cryptocurrency theft)
• Deployed WAVESHAPER.V2 backdoor
• Completely independent from the TeamPCP campaign

Common Patterns & Lessons

Attack Patterns

1. Credential theft as the entry point: Every attack began with compromising a maintainer account or token
2. Mutable tag abuse: Exploited the fact that Git tags can be force-pushed (tag poisoning)
3. Abuse of legitimate distribution channels: Malicious versions uploaded directly to PyPI/npm — package names remain legitimate, making detection via functional testing impossible
4. Cascading propagation: A single compromise propagates to downstream projects via stolen credentials
5. Security tools as attack vectors: Trivy, KICS, and similar scanners run with elevated privileges, maximizing impact when compromised

Defensive Recommendations

1. Pin GitHub Actions to commit SHAs — tags can be force-pushed
2. Pin package versions and use lockfiles — never run unpinned installs
3. Monitor CI/CD runner outbound network traffic — detect unexpected POST requests to unknown domains
4. Apply least-privilege + expiration to npm/PyPI tokens
5. Never coexist OIDC with long-lived tokens — as in the axios case, npm uses the token when both are present, nullifying OIDC
6. Perform immediate and complete credential rotation — incomplete rotation was the root cause of the Trivy cascade
7. Check for tpcp-docs / docs-tpcp repositories — TeamPCP's fallback exfiltration mechanism
8. Apply quarantine periods before auto-updating to latest versions — auto-patching in CI/CD automates your own breach

IOC Domains

• scan.aquasecurtiy[.]org (Trivy)
• checkmarx[.]zone (Checkmarx)
• models.litellm[.]cloud (LiteLLM)
• 83[.]142.209.203 (Telnyx)
• packages.npm.org (Axios, npm disguise)
• plug-tab-protective-relay.trycloudflare[.]com (Trivy Cloudflare Tunnel C2)
• ICP canister tdtqy-oyaaa-aaaae-af2dq-cai (CanisterWorm)