FBI Warns of TeamPCP Supply Chain Attack

The FBI issued an urgent FLASH alert warning that TeamPCP conducted a large-scale 2026 software supply chain campaign by injecting malicious code into popular developer and security packages (e.g., Trivy, KICS, LiteLLM, Telnyx SDK), deploying credential-stealing malware (CanisterWorm, SANDCLOCK) and self-replicating worms across npm and PyPI to harvest cloud tokens, SSH keys, Kubernetes secrets and establish persistent access; the report includes exploited CVEs, attribution to TeamPCP, and immediate mitigation guidance such as pinning workflows, rotating credentials, enforcing MFA, auditing maintainer accounts, and delaying acceptance of new packages.