TeamPCP Hits Trivy, Checkmarx, and LiteLLM in Credential Theft Campaign

**Executive summary:** Between 19–24 March 2026, an ongoing supply‑chain campaign attributed to 'TeamPCP' infected Trivy, Checkmarx tools/plugins and LiteLLM with a credential‑stealing malware that harvests cloud keys, Kubernetes tokens and Solana wallets, persists via a background service, and was distributed through poisoned updates and malicious packages; the report urges immediate rotation of keys, use of clean tool versions, and pinning packages by SHA to mitigate risk.