TeamPCP Supply Chain Campaign: A March 2026 Retrospective

TeamPCP executed a high-speed, multi-phase supply-chain campaign in March 2026 that began with a stolen Trivy CI PAT and led to poisoned GitHub Actions, malicious releases across GitHub Releases, Docker registries, npm and PyPI packages (including litellm and telnyx), internal org defacements, and credential exfiltration to attacker-controlled C2 infrastructure; the operation combined automated propagation (CanisterWorm), credential harvesting, package backdoors/stealers, and a geotargeted Iran wiper, with numerous IOCs and remediation guidance provided.