The Credentials Were Rotated. They Still Worked. by Lucie Cardiet

This report examines the TeamPCP credential archive derived from a compromised Trivy GitHub Action and briefly available poisoned LiteLLM PyPI packages, noting reconstructed exposure affecting thousands of organizations and hundreds of thousands of CI/CD pipeline artifacts; it highlights a broader collection window (Mar 19–24, 2026), failures in credential rotation and disclosure gaps, and recommends verifying that rotated credentials are actually rejected and expanding forensic searches back to late February.