Incident · Resolved

TeamPCP Supply Chain Attacks

5 stories since MAR 27

5: stories
MAY 20: latest

First reported: Mar 27, 2026
Latest: May 20, 2026

How it unfolded

Decipher story Event

MAR 27TeamPCP’s Supply Chain Attack Spree Continues
APR 22Attackers Target Checkmarx KICS Ecosystem
MAY 12Ongoing Supply Chain Attack Expands to PyPi
MAY 17Grafana Investigating Token Compromise and Extortion Attempt
MAY 20GitHub Confirms Internal Breach

The story so far

Through the spring of 2026, TeamPCP compromised open-source tools that developers and build systems trust: Aqua Trivy, Checkmarx KICS, LiteLLM, the Telnyx SDK, the Bitwarden CLI and TanStack’s npm packages. The stolen access reached Grafana Labs, which was extorted, and GitHub, which confirmed that internal repositories were taken through a poisoned VS Code extension after TeamPCP claimed the breach.

Written by the editors

Timeline · 5 stories

Oldest first ↓

MAR 27
Supply ChainTeamPCP’s Supply Chain Attack Spree ContinuesTeamPCP’s latest victim is the Telnyx Python SDK on PyPl, coming after a wave of supply chain hits on Aqua Trivy, Checkmarx KICS/OpenVSX, and LiteLLM.LINDSEY O'DONNELL-WELCH · 3 MIN
APR 22
Supply ChainAttackers Target Checkmarx KICS EcosystemYet another supply chain attack has hit the open source ecosystem, this time impacting the Checkmarx KICS Docker Hub repository.LINDSEY O'DONNELL-WELCH · 3 MIN
MAY 12
IntrusionsOngoing Supply Chain Attack Expands to PyPiResearchers have linked the compromise to the “Mini Shai-Hulud” campaign, which has been ongoing for several weeks and is associated with TeamPCP.DENNIS FISHER · 3 MIN
MAY 17
Supply ChainGrafana Investigating Token Compromise and Extortion AttemptAn “unauthorized party” obtained a token with access to the Grafana Labs GitHub environment and downloaded Grafana’s codebase.LINDSEY O'DONNELL-WELCH · 2 MIN
MAY 20
IntrusionsGitHub Confirms Internal BreachThe company said it is still working through the intrusion but does not believe any customer repositories or data was affected at this point.DENNIS FISHER · 3 MIN

TeamPCP Supply Chain Attacks

The story so far

The Decipher Brief