TeamPCP Explores Ways to Exploit Stolen Supply Chain Secrets

Researchers observed TeamPCP conducting supply-chain attacks by publishing typosquatted and backdoored PyPI packages and injecting credential-stealing malware into CI/CD pipelines and libraries (including Trivy, LiteLLM, Checkmarx KICS, and Telnyx). The group validated, encrypted, and exfiltrated cloud credentials, SSH keys, and other developer secrets to attacker-controlled domains and is reported to be collaborating with extortion and ransomware actors (Lapsus$, Vect), raising risk of large-scale follow-on ransomware campaigns.