Two men arrested in Australia this week are alleged TeamPCP members. The AFP estimate filed alongside the case puts the worm's take at more than 500,000 credentials and 300GB of data, and that scale makes token lifetime the live question.
Perspective Coverage
16 publishers
- Builder
- Builder 29%
- Operator
- Operator 56%
- Investor
- Investor 15%
Reality
- Evidence62
- Adoption68
- Hype gap+30
- Incentives58
- Confidence70
buildOne report1 publisher An agent now picks the packages the person prompting it will never see
GitHub's volume counters and Chainguard's account of agent-written code both point at dependency review as the step nobody is doing. Mandiant estimates mean time-to-exploit at minus seven days in 2025.
Reality
- Evidence43
- Adoption55
- Hype gap+27
- Incentives76
- Confidence42
An attacker force-pushed 76 of Trivy's 77 action tags to credential-stealing commits
The maintainers date the second wave to March 19, eighteen days after they disclosed the first one and rotated credentials without doing it all at once, and the only action tag that came through clean was one GitHub had already frozen.
Reality
- Evidence74
- Adoption52
- Hype gap−14
- Incentives68
- Confidence61
buildOne report1 publisher Every one of thirteen named 2025-26 incidents ran on a credential that still worked
Anthropic, Sysdig, Unit 42 and GitGuardian describe the same shape of failure, which puts the interesting number on your side of the fence: how long an issued token keeps working after it leaves your control.
Reality
- Evidence27
- Adoption44
- Hype gap+37
- Incentives71
- Confidence57
TeamPCP hid its infostealer inside the scanners that audit everyone else's code
Unit 42 says the group backdoored Trivy, KICS, LiteLLM and Telnyx's Python SDK, tools that run inside CI with the privileges needed to reach production secrets, which is also why the headline counts deserve a slow read.
Reality
- Evidence55
- Adoption58
- Hype gap+32
- Incentives78
- Confidence48
A backdoored litellm release turns every CI job that installed it into a credential incident
Datadog's investigation puts genuine PyPI releases of litellm and telnyx inside the same campaign that poisoned Trivy on March 19, which makes the unit of remediation the secrets the build could see rather than the version pin.
Publishers:securitylabs.datadoghq.com
Reality
- Evidence71
- Adoption62
- Hype gap−8
- Incentives58
- Confidence64
buildOne report1 publisher Flux moves GitOps' source of truth into registries you own, and mirroring becomes the prerequisite
Flux Mirror ships as a v2.9 CLI plugin that copies images, charts and desired-state artifacts from a config file. The Bitnami catalogue freeze is the argument for using it.
Reality
- Evidence42
- Adoption15
- Hype gap+27
- Incentives72
- Confidence46
The 2,500-org compromise was a Trivy problem. LiteLLM was the closing act.
SOCRadar's record-level data puts 95 percent of identified victims before the poisoned LiteLLM packages ever hit PyPI. Anyone who rotated only what LiteLLM touched is still exposed.
Reality
- Evidence52
- Adoption68
- Hype gap+12
- Incentives66
- Confidence55