TeamPCP’s Checkmarx GitHub Actions Attack: What You Need to Know

The report details a high-impact, multi-stage supply chain campaign by TeamPCP that began with a poisoned Trivy release and expanded to compromise Checkmarx GitHub Actions, developer tooling (OpenVSX extensions), package ecosystems (npm, PyPI), and container registries; the adversary harvested CI/CD and cloud credentials (packaged as tpcp.tar.gz), used resilient exfiltration (typosquat domains, cloud tunnels, and fallback GitHub repos), deployed self-propagating packages (CanisterWorm), and included destructive, Iran-targeted wiper capabilities—providing IoCs, recommended mitigations (rotate secrets, pin SHAs, move to OIDC, egress filtering), and mapped MITRE ATT&CK techniques for detection and response.