FBI: TeamPCP Compromised Dev Tools to Steal Cloud Credentials

The FBI alert details TeamPCP’s large-scale supply chain campaign in which attackers trojanized trusted developer/security tools (e.g., Trivy, KICS, LiteLLM, Telnyx SDK) to install credential-stealing malware and self-replicating worms that propagated across npm and PyPI, exfiltrated cloud credentials and secrets, and enabled extortion and data leakage; the alert includes IoCs (IPs, hashes, domains, CVEs) and mitigation guidance such as pinning CI workflows, rotating secrets, enforcing least-privilege, and requiring phishing-resistant MFA.