Supply Chain Confidence: What Every Organisation Needs to Know

# Executive summary Between late February and March 2026 TeamPCP executed a large, multi-stage software supply chain campaign compromising CI/CD tooling and popular packages (Trivy, Checkmarx KICS, LiteLLM, Telnyx, numerous npm packages) to steal credentials from thousands of pipelines, deploy credential-stealers and RATs, exfiltrate terabytes of sensitive data, and partner with ransomware groups for mass extortion; the report details timelines, common tactics (mutable references, long-lived tokens, trusted security tools), IOCs, and prioritized mitigation steps such as SHA-pinning, short-lived tokens/OIDC, secret scanning, package firewalls, and rebuild-and-rotate remediation.