Checkmarx KICS Code Scanner Targeted in Widening Supply Chain Hit

This report details a widespread supply-chain campaign attributed to the threat actor TeamPCP that poisoned multiple open-source developer tools and registries—Trivy, KICS GitHub Action, OpenVSX VS Code plugins, and LiteLLM on PyPI—by publishing malicious versions containing an infostealer. The compromised artifacts targeted CI/CD pipelines and developer environments to exfiltrate secrets (SSH keys, cloud credentials, API tokens, Docker configs, crypto wallet info), with active distribution windows confirmed and common IoCs linking the incidents.