Self-propagating npm supply chain malware from the 2026 TeamPCP campaign. It steals cloud and developer credentials, with decentralized C2 and wiper components.
Mandiant traced the Q2 2026 campaign to an AI coding chatbot, one prompt and a set of agent instructions that ran the scanning pipeline, fixed its own errors and rotated IPs with nobody at the keyboard.
Perspective Coverage
3 publishersReality
Unit 42 says the group backdoored Trivy, KICS, LiteLLM and Telnyx's Python SDK, tools that run inside CI with the privileges needed to reach production secrets, which is also why the headline counts deserve a slow read.
Reality
Datadog's investigation puts genuine PyPI releases of litellm and telnyx inside the same campaign that poisoned Trivy on March 19, which makes the unit of remediation the secrets the build could see rather than the version pin.
Reality
StepSecurity's first annual report logs 56 confirmed supply chain compromises and says plainly that these are its own alerts. The February change is the finding; explaining it is the hard part.
Reality
SOCRadar's record-level data puts 95 percent of identified victims before the poisoned LiteLLM packages ever hit PyPI. Anyone who rotated only what LiteLLM touched is still exposed.
Reality