Unit 42Published
Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure
By Unit 42
Excerpt
Executive Summary
Between late February and March 2026, threat group TeamPCP conducted a highly calculated, escalating sequence of supply chain threats. It systematically compromised widely trusted open-source security tools, including the vulnerability scanners Trivy and KICS and the popular AI gateway LiteLLM. The affected software also includes the official Python SDK of Telnyx.
These ongoing supply chain attacks injected malicious infostealer payloads directly into GitHub Actions and Python Package Index (PyPI) registries. Once executed during rou…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Unit 42 on unit42.paloaltonetworks.com.
Mentioned in the excerpt
More from Unit 4218
- Unit 42 - Latest Cyber Security ResearchUnit 42 · Published 16 Oct
- Unit 42 - Latest Cyber Security ResearchUnit 42 · Published 16 Oct
- Unit 42 - Latest Cyber Security ResearchUnit 42 · Published 16 Oct
- Unit 42 - Latest Cyber Security ResearchUnit 42 · Published 16 Oct
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- Investigating Ephemeral Supply Chain TamperingMandiant (Google) · Published 15 Oct
