pipebreach.com
Incident Analysis

The TeamPCP Supply Chain Cascade: How One Compromised Action Poisoned Three Open Source Projects

Critical GitHub Actions PyPI supply-chain-compromise Analysis only
April 1, 2026 · 2 min read

Methodology note. This analysis is based on public incident disclosures, GitHub audit logs, PyPI release history, and community reports published between February 27 and March 24, 2026. We have not independently reproduced the full attack chain in a lab environment. Sections marked with ⚠️ contain speculation based on available evidence.

TL;DR

  • A pull_request_target misconfiguration in Trivy’s CI (the Pwn Request pattern) gave an attacker write access to a trusted runner with access to organization secrets.
  • Non-atomic credential rotation left a residual access window that the attacker exploited.
  • 76 GitHub Actions tags were force-pushed simultaneously to point to attacker-controlled commits.
  • Runner.Worker process memory was scraped to extract masked secrets from environment variables.
  • LiteLLM’s PyPI wheel was backdoored with a post-build injection; a Python .pth file provided system-wide persistence.

Background

The Pwn Request

Credential Rotation Failure

The 76-Tag Force Push

Runner Memory Scraping

PyPI Wheel Injection

Timeline

DateEvent
2026-02-27Initial Pwn Request submitted to Trivy repository
2026-03-XXCredential rotation attempt — non-atomic window exploited
2026-03-XX76 GitHub Actions tags force-pushed
2026-03-XXLiteLLM PyPI wheel backdoor published
2026-03-24Public disclosure

Indicators of Compromise

Mitigations

DM
Daniel Malvaceda

Security researcher focused on supply chain security, CI/CD attack surfaces, and AI security.