Supply Chain Confidence: What Every Organisation Needs to Know

**Executive summary:** This Ransom-ISAC report details a high-impact, coordinated software supply chain campaign by a threat actor calling itself TeamPCP that abused mutable references and long-lived credentials to compromise tools and packages (Trivy, Checkmarx KICS, LiteLLM, Telnyx, dozens of npm packages), steal credentials at scale, establish persistent presence on developer and production systems, and partner with ransomware groups (CipherForce, Vect) to monetise access and exfiltrated data; the document contains a condensed timeline, IOCs, detection guidance, and prioritized remedial actions (SHA-pinning, token expiry, secrets management, package firewalls, runner hardening).