Ongoing supply-chain attack 'explicitly targeting' security, dev tools

Checkmarx confirmed a March 23 supply-chain incident tied to TeamPCP/Lapsus$ in which credential‑stealing malware—originating from a prior Trivy compromise—was used to poison KICS and other developer tooling, exfiltrate source code, API keys, database credentials and employee data, and compromise GitHub Actions, Open VSX plugins and Bitwarden's CLI, creating a broad downstream blast radius and potential follow‑on extortion/ransomware activity.