The digital perimeter of modern enterprise environments has shifted from the traditional physical firewall to the ethereal boundaries of the CI/CD pipeline, where identity has become the most vulnerable and valuable currency for sophisticated threat actors. TeamPCP successfully transitioned from compromising a security tool to breaching the LiteLLM library by inheriting trusted publishing credentials from a shared environment. This 2026 campaign represents a landmark event in the evolution of software supply-chain security, shifting the primary focus from simple artifact poisoning to a more sophisticated, identity-centric model of persistent compromise. The campaign, which moved from a vulnerability in the Trivy security scanner to a catastrophic breach of the LiteLLM project, serves as a masterclass in how modern threat actors exploit the interconnected nature of automated delivery systems. According to an investigation by security researchers, the central failure in managing this breach was the conflation of removing a malicious software artifact with the total containment of a supply-chain compromise. TeamPCP demonstrated that while code can be rolled back, surviving identities and stolen publishing privileges provide long-term access.
From Persistent Access to Mass Credential Harvesting
Orchestrating Downstream Pipeline Infiltration: The Silent Execution
The campaign’s initial success was rooted in the ability of TeamPCP to survive the first attempt at remediation by the maintainers of the Trivy security tool. The intrusion began when attackers exploited a high-risk workflow that allowed external code to run in a privileged context, granting access to repository-level secrets. Through this initial breach, the threat actors siphoned credentials tied to the project’s automated delivery infrastructure. Although the security team identified the compromise and revoked known affected credentials, the remediation was ultimately incomplete. Because all credentials and identities were not invalidated simultaneously, a surviving token allowed the attackers to maintain a foothold and harvest newly rotated secrets over a 20-day survival window. This specific window of opportunity allowed the group to embed themselves deeply within the release cycles of the target project, ensuring that any subsequent updates would carry their influence.
Once TeamPCP secured its persistence within the release environment, it transitioned to the next phase: turning downstream CI/CD runners into credential-collection points. The attackers inserted a malicious code block into the compromised workflow designed to execute immediately upon the launch of a CI job. This allowed the script to search the runner for sensitive information before the legitimate security scan even began. Once the theft was complete, the scan would proceed normally, leaving little indication to the user that any malicious activity had occurred within the environment. This redirection of the scanner’s purpose turned a tool designed for defense into a primary vector for offense. By hijacking the “pre-execution” phase of the workflow, the actors ensured they had first-mover advantage, capturing environmental data that would otherwise be shielded by the security tool’s own monitoring processes once they were fully initialized and running.
Tailoring Data Collection: Adapting to Runner Environments
The data-collection logic employed by TeamPCP was specifically tailored to the type of runner being used by the victim organization. For GitHub-hosted runners, the code scrutinized process memory to capture short-lived authentication material that exists only during the job execution window. These ephemeral tokens are often overlooked by standard security audits because they expire quickly, yet for an active attacker, they provide immediate and high-level access to the repository and related cloud services. By targeting the memory of the runner itself, TeamPCP bypassed the file-system monitoring that many organizations rely on to detect unauthorized changes. This level of sophistication highlights a deep understanding of the internal mechanics of CI/CD platforms, where the transient nature of the environment is used as a shield to hide the extraction of critical authentication material from plain view.
On self-hosted runners, the script conducted a much deeper and more aggressive sweep, targeting highly sensitive data including SSH keys, cloud provider credentials, Kubernetes tokens, and Terraform state files. Because self-hosted runners are often integrated more deeply into the internal network of an organization, they act as a nexus for infrastructure deployment and repository access. They provided TeamPCP with a one-stop-shop for credentials that granted permissions far beyond the immediate runner environment. The attackers recognized that self-hosted infrastructure often lacks the strict isolation found in managed cloud services, allowing them to pivot from a single build job to the broader production environment. This methodical approach to data harvesting ensured that the threat actors could maintain access even if the initial entry point was discovered and closed, effectively diversifying their portfolio of stolen identities.
The Strategy of Trust Inheritance and Identity Abuse
Pivoting to LiteLLM: The Abuse of Publishing Credentials
The move from the Trivy compromise to the LiteLLM breach underscores the most dangerous aspect of the TeamPCP strategy: the exploitation of software-publishing credentials. Unlike standard repository secrets, which might only grant access to a specific branch or piece of code, publishing credentials like PyPI tokens authorize the creation of new software artifacts under a project’s official, trusted identity. LiteLLM utilized a shared environment where the compromised scanning step had visibility into environment variables across the entire pipeline. These variables included static release credentials for PyPI and Docker Hub, which the attackers used to distribute poisoned packages through official distribution channels that users already trusted. This transition from a tool vulnerability to a package-repository breach demonstrated how lateral movement in 2026 is often achieved through identity inheritance rather than traditional network exploitation.
By hijacking the identity of a trusted library, the threat actors effectively circumvented the security evaluations that most organizations perform on third-party software. When a developer downloads a package from a primary repository like PyPI, there is an implicit trust that the artifact is the legitimate product of the project maintainers. TeamPCP leveraged this trust to push updates that appeared legitimate to automated dependency managers and security scanners alike. The use of shared environment variables meant that even if the source code itself was clean, the process of packaging and shipping that code was compromised. This highlights a critical flaw in modern build architectures where different stages of the pipeline share the same security context. The attackers did not need to compromise the developer’s laptop; they only needed to compromise the “identity” of the build server to own the entire downstream distribution network.
Sophistication and Evolution: The Development of Malicious Payloads
As the campaign progressed through the middle of 2026, TeamPCP refined its methods for ensuring execution on victim systems by moving toward more aggressive persistence. Initial versions of the malicious LiteLLM library required a user to call a specific module for the code to run, which provided a small window for manual detection. However, later versions utilized Python initialization files to trigger execution the moment an interpreter started, leaving no room for user intervention. This aggressive approach eventually led to the discovery of the breach, as a flaw in the initialization mechanism caused an infinite recursive loop that crashed machines. While this technical error led to the campaign’s exposure, it also revealed the extent of the actors’ ambitions to establish a permanent presence on every machine that imported the library, regardless of how the library was used.
The payload itself was designed to establish a “System Telemetry Service” for persistence, a name chosen to blend in with legitimate system processes and evade the notice of system administrators. In Kubernetes environments, the malware attempted to create privileged pods that could scan for secrets across various namespaces, aiming for a complete takeover of the container orchestration platform. This shows that the attackers were not just interested in stealing credentials from the CI/CD pipeline, but were also focused on post-exploitation activities within production clusters. The ability to automatically detect and adapt to a Kubernetes environment demonstrates a level of engineering usually reserved for state-sponsored actors. By attempting to establish high-privilege pods, the malware sought to break the isolation boundaries of the container runtime, potentially exposing every other service running on the same hardware.
Analyzing the Identity-Trust Cycle: Converting Trust into Privilege
The consolidated evidence from the 2026 investigations reveals a recurring strategic pattern employed by TeamPCP that centers on converting existing trust into new privileges. The process begins with identifying a trusted software delivery path and acquiring the authentication material behind it. By inheriting these legitimate identities, attackers can bypass traditional security perimeters and abuse trusted distribution channels to push malicious artifacts. Each newly compromised environment then serves as a fresh harvesting ground for credentials, allowing the cycle to restart and expand across the software ecosystem. This trust-based propagation is far more effective than traditional malware because it uses the infrastructure of the defenders against them, making it incredibly difficult to distinguish between legitimate maintenance activities and a sophisticated supply-chain attack.
This cycle of identity abuse creates a “snowball effect” where the scope of the compromise grows exponentially with each successful pivot. Because the attackers were operating as legitimate service accounts, their activities did not trigger the usual alerts associated with unauthorized access or brute-force attempts. They were essentially “living off the land” within the CI/CD environment, using the existing tools and permissions to further their goals. This strategy forces a reevaluation of what it means to have a “secure” environment. If the very identities used to secure and deploy the environment are compromised, then the entire concept of a trust boundary is rendered obsolete. The TeamPCP campaign showed that the modern attacker is more interested in becoming a part of the system than in breaking it, as being a part of the system provides much more stability and longevity.
Forensic Evidence and Boundary Analysis
Maintaining Objectivity: The Limits of Forensic Reconstruction
While the relationship between the Trivy compromise and the LiteLLM breach is supported by a significant body of technical evidence, it is important to maintain clear forensic boundaries during the analysis. Certain specific artifacts, such as the exact job IDs that leaked tokens or the specific IP addresses used for the initial malicious uploads, have not always been released to the public by the involved parties. Therefore, the sequence of events remains a highly probable reconstructed attack path rather than a formally closed forensic chain of custody. This distinction is vital for maintaining the integrity of the analysis while acknowledging the clear patterns of behavior exhibited by the threat actor throughout the 2026 campaign. Researchers must balance the need for public awareness with the reality of incomplete data sets and the potential for overlapping actor activities.
The reconstruction process involves stitching together disparate logs from different platforms, which often lack a unified time-sync or consistent naming convention. This challenge is compounded by the fact that sophisticated actors like TeamPCP frequently use anti-forensic techniques to mask their origins and delete their tracks. Despite these obstacles, the technical indicators—such as the similarity in code structure between the various malicious payloads—provide a strong link between the different stages of the campaign. By focusing on the patterns of behavior and the specific methodologies used for credential extraction, investigators can build a convincing case for the actor’s identity and intent. This approach moves beyond simple file hashes and looks at the “tradecraft” of the attacker, which is much harder to change and provides a more reliable indicator of a coordinated campaign.
Assessing the Scope: Containment and Lateral Movement Constraints
Despite the severity of the breach, the impact on LiteLLM was contained in specific ways that highlight the limitations of the attacker’s reach. Maintainers reported that no malicious code reached the main source repository and that internal corporate systems remained unaffected by the delivery-side compromise. The attackers appeared to focus specifically on the CI/CD and release boundary, which offered the highest return on investment for distributing their payload to the widest possible audience. This suggests a disciplined approach by TeamPCP, prioritizing the exploitation of the delivery pipeline over deep lateral movement into the target organization’s internal infrastructure. By staying within the build environment, they minimized the risk of detection by internal network monitoring tools that might have flagged unusual traffic between departments.
This focus on the delivery boundary reflects a strategic choice to maximize “blast radius” while minimizing exposure. Deep lateral movement into a corporate network often requires navigating complex security layers, including multi-factor authentication and endpoint detection, which increases the likelihood of being caught. In contrast, the CI/CD pipeline is often highly automated and less scrutinized, making it an ideal environment for long-term persistence. The containment of the breach to the release stages was likely a result of the clear separation between the development environment and the release environment, a security practice that many organizations are now beginning to prioritize. This boundary serves as a vital firewall that, if maintained correctly, can prevent a supply-chain attack from turning into a full-scale corporate data breach, even when the release process itself is owned by the adversary.
Reevaluating Supply-Chain Defense Mechanisms
Prioritizing Identity: Moving Beyond Artifact Security
The TeamPCP campaign serves as a stark reminder that software security is only as strong as the identities that manage it. A primary takeaway for the cybersecurity community in 2026 was that remediation must be identity-focused rather than just code-focused. Simply updating a library or deleting a malicious file is insufficient if the underlying service accounts and automation tokens are not fully audited and simultaneously rotated. Effective defense requires treating the identities used in automation with the same level of scrutiny as human administrative accounts. Organizations realized that a single compromised service account can do more damage than a thousand stolen passwords, as service accounts often have wide-ranging permissions and rarely change their credentials without manual intervention.
To address this, security teams began implementing stricter identity governance for their automated systems, including the use of short-lived tokens and machine identity management platforms. The goal was to reduce the “half-life” of a stolen credential, making it useless to an attacker before they could even finish their reconnaissance. By shifting the focus from the code to the identity, organizations can create a more resilient posture that assumes a breach will eventually occur. This “zero-trust” approach to service identities ensures that every action taken by an automated system is verified and authorized in real-time, rather than relying on static credentials that stay valid for months or years. The campaign proved that in the world of modern software delivery, identity is the ultimate perimeter, and protecting that perimeter requires a radical shift in how we manage automated permissions.
Distribution Channel Risks: The Double-Edged Sword of Trust
The trust inherent in established distribution channels like PyPI and Docker Hub is a double-edged sword that TeamPCP exploited with great effect. While these platforms provide a baseline of reliability for developers, they also act as force multipliers for attackers who manage to obtain valid publishing credentials. When a malicious package is delivered through an official channel, traditional security checks often fail because the source is deemed legitimate. Organizations realized they must implement additional layers of verification, such as binary signing and independent artifact analysis, to ensure that the artifacts they ingest have not been tampered with at the release boundary. The reliance on external repositories without local verification was identified as a major systemic vulnerability that required immediate attention.
As a result, many enterprises moved toward hosting their own internal “golden” repositories, where every package is scanned and verified before being made available to internal developers. This “curated” approach to third-party software helps to mitigate the risk of a poisoned update by introducing a manual or automated gate between the public internet and the internal build environment. Furthermore, the use of Software Bill of Materials (SBOM) became mandatory for tracking the provenance of every component in a software stack. By having a clear understanding of where every piece of code came from and who signed it, organizations could more quickly respond to incidents and identify potentially compromised assets. The campaign forced the industry to move away from implicit trust and toward a model of explicit, verified identity for every stage of the software lifecycle.
Advancing CI/CD Security: Actionable Lessons from the Campaign
The reconstruction of the TeamPCP campaign highlighted that the group’s greatest asset was its ability to persist within the delivery infrastructure. By surviving initial cleanup efforts and moving horizontally through the supply chain, the group demonstrated that permissions and identities were the most valuable currency in modern software delivery. Long-term containment of such threats required organizations to treat CI/CD secrets as critical assets that represented their entire reputation and the safety of their downstream users. The community learned that incomplete remediation is often worse than no remediation, as it provides a false sense of security while the attacker continues to harvest data and refine their access. Simultaneous rotation of all secrets across the entire pipeline became the gold standard for incident response.
In the aftermath of the campaign, organizations implemented more rigorous isolation between different stages of the CI/CD process. This ensured that a vulnerability in a security scanner or a testing tool could not lead to the compromise of publishing credentials. The industry also adopted more aggressive monitoring of service account behavior, using anomaly detection to flag when an automation token was used from an unusual location or for an unusual purpose. These proactive steps, combined with the widespread adoption of OIDC-based identity providers for cloud deployments, significantly reduced the viability of the TeamPCP playbook. The 2026 events ultimately pushed the sector toward a more mature understanding of automated identity, where every token is treated as a temporary privilege that must be continuously earned through verified behavior and strict environmental controls.
