Executive Summary

Between December 2025 and May 2026, a threat actor known as PCPcat, first publicly documented by Rubrik Zero Labs on December 19, 2025, and later associated with the broader TeamPCP operation, conducted a series of campaigns that demonstrated a notable transition from cloud-native intrusion activity to software supply chain compromise.

The campaign initially focused on exposed cloud infrastructure, container platforms, Kubernetes environments, and vulnerable internet-facing applications. By targeting cloud-native technologies and externally accessible services, the attackers established access across diverse environments and gained visibility into cloud and development ecosystems.

As the operation matured, TeamPCP shifted its focus toward trusted software distribution channels and developer ecosystems. High-profile compromises involving Trivy, LiteLLM, Checkmarx, Jenkins plugins, Visual Studio Code extensions, GitHub repositories, and numerous npm and PyPI packages illustrated a deliberate effort to target the systems used to build, distribute, and maintain software.

A defining characteristic of the campaign was the systematic targeting of privileged access. GitHub tokens, CI/CD secrets, publishing credentials, cloud authentication material, and developer accounts repeatedly served as enablers for subsequent compromises. Access to these assets allowed the attackers to compromise software publishing workflows, distribute malicious updates through trusted channels, and expand into additional development environments.

The operation also demonstrated a steady evolution in tradecraft. Early cloud-focused activity gave way to increasingly sophisticated supply chain techniques, including Git tag manipulation, GitHub Actions compromise, malicious package publication, Docker image poisoning, IDE extension abuse, workflow injection, and automated propagation across package ecosystems. The emergence of Mini Shai-Hulud highlighted the ability to leverage compromised credentials and publishing permissions to scale attacks across both npm and PyPI registries.

Collectively, these incidents demonstrate how modern software development ecosystems have become high-value targets for threat actors seeking privileged access and broad downstream reach. The campaign underscores the importance of securing developer identities, CI/CD platforms, software publishing workflows, package registries, cloud environments, and the trust relationships that connect them.

This report chronicles the evolution of the campaign from the initial PCPcat cloud-native intrusion framework through the emergence of TeamPCP's software supply chain operations and the large-scale propagation activity associated with Mini Shai-Hulud.

Key Takeaways

• TeamPCP-associated operations impacted multiple software distribution ecosystems, including GitHub Actions, Docker Hub, Jenkins Marketplace, OpenVSX, Visual Studio Code extensions, npm, and PyPI, demonstrating an unusually broad attack surface across modern software development environments.
• The GitHub breach alone reportedly resulted in the exfiltration of approximately 3,800 internal GitHub repositories, while downstream compromises affected numerous open-source projects, developer tools, and software distribution channels.
• Mini Shai-Hulud propagation waves compromised more than 80 TanStack package versions, over 320 AntV packages, multiple SAP CAP packages, and numerous npm and PyPI projects associated with AI, cloud, and enterprise development ecosystems.
• The campaign successfully abused GitHub Actions, Docker images, VSCode/OpenVSX extensions, Jenkins plugins, npm packages, and PyPI packages, allowing malicious code to be distributed through platforms routinely trusted by developers and organizations.
• A single compromise often provided access to additional repositories, publishing credentials, developer environments, and software distribution mechanisms, enabling the campaign to extend far beyond its initial targets and affect a much broader ecosystem.

Timeline and Motivation

The timeline illustrates the evolution of TeamPCP from a cloud-native intrusion campaign into a large-scale software supply chain operation. Throughout the campaign, the attackers consistently targeted trusted development ecosystems, software publishing workflows, and privileged credentials to expand their reach across cloud, CI/CD, and developer environments.

The campaign appears to have been driven by several primary objectives:

• Cloud Credential Theft – Harvesting cloud authentication tokens, Kubernetes secrets, SSH keys, and environment-based credentials to obtain access to cloud infrastructure and cloud-native environments.
• Identity and Access Compromise – Targeting GitHub tokens, developer accounts, CI/CD secrets, npm publishing credentials, and PyPI publishing credentials to gain privileged access to software development ecosystems.
• Software Supply Chain Abuse – Leveraging compromised credentials and publishing workflows to distribute malicious code through trusted software distribution channels, including GitHub Actions, package registries, container repositories, IDE extensions, and Jenkins plugins.
• Propagation Through Trusted Relationships – Expanding access across interconnected repositories, development environments, package ecosystems, and downstream organizations by abusing existing trust relationships within the software supply chain.

These objectives collectively enabled TeamPCP to scale from infrastructure-focused intrusions to widespread compromises affecting multiple software ecosystems and development platforms.

Campaign Evolution and Major Incidents

PCPcat Cloud-Native Intrusion Campaign

On December 19, 2025, Rubrik Zero Labs published research detailing a large-scale cloud-native intrusion campaign attributed to a threat actor known as PCPcat, later associated with a broader TeamPCP operation. The campaign targeted internet-exposed cloud infrastructure, container platforms, Kubernetes environments, and modern web applications, demonstrating a highly automated approach to cloud-native compromise and post-exploitation activity.

Initial Access and Target Discovery

The campaign primarily leveraged CVE-2025-55182, a critical Next.js remote code execution vulnerability, to gain initial access to internet-facing applications. In parallel, the threat actor conducted large-scale internet scanning to identify exposed infrastructure, targeting Docker remote API services on ports 2375 and 2376, Redis servers on port 6379, Ray clusters on port 8265, and Kubernetes API servers on port 6443.

Following successful exploitation, the attackers deployed a bootstrap orchestration script named proxy.sh, which served as the central controller for the PCPcat framework. The script downloaded and executed multiple operational modules, including react.py for Next.js exploitation and propagation, scanner.py for infrastructure discovery and Docker scanning, and kube.py for Kubernetes reconnaissance, credential harvesting, and lateral movement across cloud-native environments.

Distributed Proxy Mesh Infrastructure

One of the most distinctive features of the campaign was its use of a distributed proxy infrastructure. The malware deployed GOST SOCKS5 proxies and FRP reverse tunneling agents, enabling attackers to establish covert access channels, bypass network restrictions, and pivot into private cloud environments. Rather than using traditional command-and-control infrastructure, compromised systems were transformed into relay nodes that supported future operations.

Kubernetes-Aware Lateral Movement

The framework demonstrated significant cloud-native awareness. Using the kube.py module, the attackers enumerated Kubernetes workloads, executed commands within running containers, and propagated across cluster nodes and namespaces. At the same time, infected hosts continued scanning for additional Docker, Redis, Ray, and Kubernetes exposures, creating a recursive propagation model where compromised systems actively participated in expanding the campaign.

Persistence Mechanisms

To maintain access, TeamPCP implemented multiple persistence mechanisms. Depending on the environment, the malware established system services, background processes, cron jobs, and Kubernetes DaemonSet-style deployments to ensure continued execution across both traditional Linux systems and containerized infrastructure.

Credential Harvesting and Monetization

The campaign's primary objective appeared to be monetization through credential theft and infrastructure abuse. The malware harvested cloud credentials, Kubernetes secrets, Docker authentication data, Git tokens, SSH keys, and sensitive environment files. It also targeted cryptocurrency-related assets, including MetaMask data and blockchain wallet credentials associated with Ethereum, Solana, and Bitcoin ecosystems.

Compromised systems may have been repurposed for proxy resale services, anonymous traffic routing, internal network access, and unauthorized cryptocurrency mining operations. The combination of large-scale exploitation, Kubernetes-aware lateral movement, distributed proxy mesh construction, cloud credential harvesting, and multiple monetization opportunities distinguished TeamPCP from traditional cryptomining botnets and established it as one of the more sophisticated cloud-focused threat campaigns observed during 2025.

Trivy GitHub Actions Supply Chain Compromise

On March 19, 2026, attackers compromised the trusted GitHub Actions repositories aquasecurity/trivy-action and aquasecurity/setup-trivy, marking the first major software supply chain operation publicly associated with TeamPCP. The incident was later tracked as CVE-2026-33634. Rather than publishing obviously malicious releases, the attackers forcefully redirected 75 trusted Trivy version tags to attacker-controlled commits. By abusing Git tags instead of modifying active branches, they ensured that workflows referencing versions such as aquasecurity/trivy-action@0.33.0 automatically downloaded malicious code while continuing to appear as legitimate releases.

Credential Harvesting from GitHub Actions Runners

The malware specifically targeted GitHub Actions runner environments and searched for processes such as Runner.Worker, Runner.Listener, runsvc, and run.sh. Once identified, it harvested secrets from /proc/<pid>/environ and extracted environment variables containing GitHub tokens, cloud credentials, deployment secrets, SSH keys, Kubernetes tokens, and CI/CD authentication material. Collected data was written to temporary files such as /tmp/runner_collected_.txt before exfiltration.

CI/CD Process Memory Dumping

One of the most notable techniques observed during the attack was direct process memory harvesting. The malware enumerated memory mappings through /proc/<pid>/maps and dumped the memory of the Runner.Worker process using /proc/<pid>/mem, enabling the collection of sensitive secrets stored within running CI/CD processes.

Unlike traditional software supply chain attacks that focus on malware delivery, the primary objective of the Trivy compromise was credential theft from CI/CD environments. By targeting GitHub Actions runners, the attackers gained access to highly privileged deployment credentials, cloud authentication tokens, signing infrastructure, and repository secrets capable of enabling downstream compromise of additional software ecosystems.

LiteLLM PyPI Supply Chain Compromise

The LiteLLM supply chain compromise is widely believed to have been a downstream consequence of the earlier Trivy GitHub Actions breach conducted by TeamPCP. During the period when malicious Trivy Action tags were active, LiteLLM's CI/CD pipeline reportedly incorporated the affected GitHub Action as part of its workflow. The close timing of the incidents, combined with overlapping infrastructure, malware artifacts, and operational tradecraft, strongly suggests that the LiteLLM compromise was part of the broader TeamPCP campaign rather than an isolated event.

On March 24, 2026, attackers compromised the PyPI publishing pipeline of LiteLLM and released malicious versions 1.82.7 and 1.82.8. Unlike the Trivy compromise, which primarily targeted CI/CD runners and deployment environments, this operation focused on AI infrastructure and Python development ecosystems where LiteLLM is commonly deployed as a gateway for multiple large language model providers.

The initial malicious release, v1.82.7, embedded attacker-controlled code directly within litellm/proxy/proxy_server.py. By modifying an existing trusted component rather than introducing a standalone malicious file, the attackers ensured that the payload executed as part of normal LiteLLM proxy operations. The compromised code collected sensitive data and packaged it into archives such as tpcp.tar.gz before transmitting it to attacker-controlled infrastructure.

Interpreter-Level Persistence via .pth Files

The most notable evolution appeared in v1.82.8, where the attackers introduced a malicious Python startup file named litellm_init.pth. Unlike traditional Python package backdoors that rely on an application importing a compromised module, the .pth file leveraged Python's startup initialization mechanism to achieve code execution during interpreter initialization.

By placing the file within Python's site-packages directory, the attackers effectively elevated the compromise from a package-level backdoor to an interpreter-level execution mechanism. This significantly broadened the attack surface, allowing the malicious code to execute across a wide range of Python-based environments, including notebooks, automation frameworks, AI workloads, development tools, and other applications unrelated to LiteLLM itself.

Checkmarx Supply Chain Compromise

The Checkmarx supply chain compromise is widely believed to have been a downstream consequence of the earlier Trivy GitHub Actions breach conducted by TeamPCP. Following the compromise of Trivy CI/CD environments, attackers gained access to credentials, deployment secrets, and trusted publishing workflows that were subsequently leveraged to target additional software ecosystems. 

Between March 23 and March 27, 2026, attackers compromised multiple Checkmarx distribution channels, including GitHub Actions repositories, Docker Hub artifacts, and OpenVSX extensions. Affected repositories included checkmarx/ast-github-action and checkmarx/kics-github-action, while malicious artifacts were also distributed through the official checkmarx/kics Docker repository and Checkmarx-associated OpenVSX extensions.

GitHub Actions Workflow Poisoning

The compromised Checkmarx GitHub Actions components executed attacker-controlled code during workflow execution. Similar to the Trivy compromise, the injected code executed before legitimate scanning operations and harvested secrets from GitHub Actions runner environments.

The malware searched for GitHub Actions and self-hosted runner processes, collected environment variables, SSH keys, and other sensitive data from the execution environment, and staged the collected information within temporary files for processing. If a GitHub Actions runner was detected, the malware accessed the memory of the Runner.Worker process through /proc/<pid>/mem and extracted secrets directly from process memory. Additional discovery routines searched common system locations, cloud-related configuration files, and Kubernetes environments for accessible secrets and authentication material. 

The harvested secrets provided access to additional repositories, cloud environments, and software distribution channels, enabling the campaign to expand beyond the initial compromise.

Docker Hub Artifact Poisoning

A significant evolution of the campaign involved the compromise of official KICS Docker images distributed through the legitimate checkmarx/kics Docker Hub repository. Organizations that pulled and executed the affected images as part of routine security scanning workflows unknowingly executed attacker-controlled code within their CI/CD environments.

Because these images were routinely used within containerized build environments and cloud-native CI/CD workflows, the compromise expanded TeamPCP's access opportunities beyond GitHub Actions into environments where Kubernetes, containers, and deployment automation were commonly integrated.

VSCode/OpenVSX Extension Compromise

The campaign also targeted developer workstations through compromised OpenVSX extensions, including cx-dev-assist and ast-results. Attacker-controlled JavaScript was incorporated into the extension packages and executed when the extensions were installed or activated within Visual Studio Code-compatible environments. This represented a shift from targeting centralized CI/CD infrastructure toward developer endpoints, where source code, development tools, authentication artifacts, and other sensitive resources were often accessible.

Automated Workflow Injection

One of the most advanced capabilities observed during the Checkmarx campaign was the automated injection of malicious GitHub Actions workflows using stolen GitHub credentials. The malware created new branches in accessible repositories and committed attacker-controlled workflow files into the .github/workflows/ directory.

A notable example was .github/workflows/format-check.yml, a malicious workflow disguised as a legitimate CI/CD validation task. The malware leveraged stolen GitHub credentials from compromised developer and CI/CD environments to create new branches and commit the workflow into accessible repositories. The act of committing the workflow triggered execution within GitHub Actions environments, transforming compromised repositories into additional propagation points for the campaign.

NPM Ecosystem Traversal and Propagation

Another notable capability observed during the Checkmarx campaign was the abuse of stolen npm publishing credentials. The malware searched for authentication tokens stored in .npmrc files and used them to identify npm packages that the victim had permission to modify.

Once writable packages were identified, the attackers automatically published malicious versions containing TeamPCP payloads. This transformed compromised developer accounts into propagation points, allowing the malware to spread beyond a single repository and rapidly expand across the npm ecosystem and downstream software supply chains.

Jenkins CI/CD Infrastructure pivoting

Between May 9 and May 10, 2026, TeamPCP compromised the official Checkmarx AST Scanner Jenkins Plugin(checkmarx-ast-scanner-2026.5.09) and distributed it through the Jenkins Marketplace. Unlike earlier operations that targeted GitHub Actions, npm packages, Docker images, and developer workstations, this phase directly targeted Jenkins controllers and enterprise CI/CD orchestration environments.

Nx Console VSCode Extension Compromise and GitHub Breach

The GitHub breach is widely believed to have originated from the compromise of the Nx Console Visual Studio Code extension (nrwl.angular-console v18.95.0), which was published to the Visual Studio Marketplace and OpenVSX on May 18, 2026. The malicious release remained available for a short period before removal, but it was sufficient to compromise developer workstations and ultimately contributed to the exfiltration of approximately 3,800 GitHub internal repositories. The incident is tracked as CVE-2026-48027 and has been widely associated with TeamPCP. Following public disclosure of the breach, TeamPCP claimed responsibility through its Telegram channel and advertised the alleged sale of exfiltrated GitHub data.

VSCode Extension Execution

The compromised Nx Console extension contained obfuscated JavaScript within main.js that masqueraded as legitimate MCP functionality. Upon workspace activation, the extension retrieved the nx-next package from an orphaned commit within the trusted nrwl/nx repository. The package's index.js entry point executed the next stage of the attack chain, ultimately launching the credential-harvesting payload.

Mini Shai-Hulud: TeamPCP’s Self-Propagating Supply Chain Worm

Mini Shai-Hulud is a variant of the broader Shai-Hulud malware family and is widely attributed to TeamPCP. Emerging in late April 2026, the campaign represented a significant escalation in software supply chain tradecraft by combining credential theft, automated package discovery, and self-propagating package publication across both the npm and PyPI ecosystems.

Unlike traditional package compromises that typically target a single project or maintainer account, Mini Shai-Hulud was designed to expand automatically once a developer environment was compromised. The malware harvested developer credentials, GitHub tokens, CI/CD secrets, cloud authentication material, and package publishing credentials, then used that access to identify additional repositories and packages under the victim's control. Malicious package versions were subsequently published to trusted registries, enabling the campaign to spread through normal software installation and dependency update processes.

The campaign primarily targeted open-source projects, developer tooling, AI-related packages, enterprise software ecosystems, and cloud-native development environments. Through repeated propagation waves, the malware compromised packages associated with SAP CAP, Intercom, Lightning AI, TanStack, UiPath, Mistral AI, OpenSearch, Guardrails AI, AntV, and other projects. This approach transformed trusted package registries into distribution channels, allowing the attackers to reach a large number of downstream developers and organizations through existing software supply chains. 

The following sections discuss some of the more interesting techniques and operational characteristics observed during the campaign.

Developer Tooling and AI Assistant Abuse

Mini Shai-Hulud extended its propagation beyond package registries by using stolen GitHub credentials to commit malicious files into victim repositories. The malware modified Claude Code and Visual Studio Code configuration files, introducing automatic execution mechanisms that triggered when repositories were opened in developer environments. This allowed the worm to persist within developer workflows and propagate to additional users interacting with affected repositories.

Token Revocation Dead-Man's Switch

Mini Shai-Hulud monitored a GitHub personal access token created on compromised systems and used it as a dead-man's switch. Certain variants were designed to trigger destructive actions when the monitored token was revoked, resulting in the deletion of data from the compromised user's home directory. This unusual behavior linked token revocation to data destruction, complicating containment, remediation, and recovery efforts.

The table below summarizes the major Mini Shai-Hulud supply chain attacks observed between April and May 2026, highlighting the targeted ecosystems, affected package registries, and notable propagation activity associated with each campaign wave.

Conclusion

The events examined throughout this report illustrate a fundamental shift in how modern threat actors operate. Rather than targeting end users directly, attackers increasingly focus on the trust relationships that underpin software development and distribution. As development workflows become more automated and interconnected, a compromise at one point in the ecosystem can rapidly influence thousands of downstream users, organizations, and services.

The TeamPCP activity demonstrates that software supply chains are no longer isolated collections of repositories, build systems, and package registries. They form a tightly connected ecosystem where developer workstations, CI/CD platforms, cloud infrastructure, publishing pipelines, and third-party dependencies all contribute to the overall security posture. As a result, defending against future supply chain threats will require organizations to treat trust as a continuously monitored security boundary rather than an implicit assumption.