The Federal Bureau of Investigation has warned that TeamPCP carried out software supply chain attacks targeting developer and security tools used in enterprise software environments.
TeamPCP compromised trusted software distribution channels in 2026 by injecting malicious code into legitimate packages, according to the FBI. The modified packages were used to deliver credential-stealing malware and persistent backdoors into developer environments and downstream systems.
Developer and security tools were targeted
The affected tools included Trivy, KICS, LiteLLM, and the Telnyx Python SDK, among others. These tools are used in development, security, cloud, and application workflows.
Trivy is used to scan repositories, container images, binary artefacts, Kubernetes clusters, and Infrastructure as Code files for vulnerabilities and misconfigurations. KICS is an open-source static analysis tool used to check Infrastructure as Code.
LiteLLM provides a proxy that acts as an OpenAI-compatible gateway for working with multiple large language model providers through a unified API. The Telnyx Python SDK gives Python developers access to the Telnyx REST API from Python 3.8 and later applications.
TeamPCP modified software components and development dependencies to push trojanized updates, the FBI said. The updates appeared normal to users while installing credential-stealing malware and backdoors.
The group used these access points to extract cloud access tokens, SSH keys, Kubernetes secrets, API keys, and other authentication material. The stolen credentials included material associated with AWS, Google Cloud Platform, and Microsoft Azure.
CI/CD systems can hold credentials used to build, test, publish, and deploy software. A compromised dependency or workflow can expose access to code repositories, package registries, cloud services, and downstream systems.
The FBI said organisations affected by the campaign should treat stolen data and credentials as a continuing risk. TeamPCP has also engaged in extortion, including publishing victim names on a public leak site and threatening to disclose stolen data.
FBI identifies malware used in the campaign
The advisory identified several malware families and tools used by TeamPCP. CanisterWorm was designed to collect cloud access tokens, credentials, API keys, and other authentication material.
SANDCLOCK was used to extract AWS credentials, Kubernetes ServiceAccount tokens, local environment variables, and cryptocurrency wallet data. The FBI also named Mini Shai-Hulud, a self-replicating software supply chain worm that operates across npm and PyPI.
Another tool, Miasma, was described as a variant of Mini Shai-Hulud. It self-propagates across open-source registries such as npm and PyPI, harvests credentials, and poisons configuration files.
Affected organisations asked to report intrusions
The FBI is asking organisations that suspect a TeamPCP intrusion to contact their local FBI field office, call 1-800-CALL-FBI, or submit a report to the Internet Crime Complaint Center.
Organisations are advised to retain affected package names and versions, CI/CD pipeline logs, network logs, exposed credentials or secrets, and any extortion communications or ransom demands. The FBI also asked for the date of discovery, estimated date of initial infection, observed activity, affected systems, submitting organisation, and a designated point of contact.
FBI recommends CI/CD and package security controls
The agency recommended that network defenders pin all GitHub Actions workflows to verified commit SHA hashes instead of floating version tags or branch references, which can change over time.
GitHub’s security guidance also advises users to limit workflow permissions. Its documentation says the GITHUB_TOKEN should be granted the minimum required permissions, with read-only access used as the default where possible and higher permissions added only when needed.
The FBI also advised organisations to rotate CI/CD secrets, publishing tokens, and cloud credentials that may have been exposed. This includes credentials used by build runners, package publishing processes, cloud deployment jobs, and third-party integrations connected to the pipeline.
Organisations should search GitHub repositories for “tpcp-docs” or “docs-tpcp” repositories. According to the advisory, these repositories are created by the worm using stolen credentials.
The FBI also recommended least-privilege permissions and scoped tokens for CI/CD service accounts and registry publishing access.
Other recommendations focused on runtime monitoring in CI/CD pipelines. The FBI advised organisations to detect unexpected outbound network connections from runner processes, unexpected triggers, privilege escalations, unauthorised artefact uploads, and deviations from normal pipeline execution patterns.
The advisory called for audits of npm package maintainer accounts, especially accounts linked to stale or expired recovery email domains that could be used in account takeovers.
The FBI recommended phishing-resistant multi-factor authentication for accounts with access to code repositories or package registries. It also advised enforcing a minimum package age threshold, such as seven days, across package installation environments.
The FBI said package-age thresholds can reduce exposure to newly published malicious versions before detection occurs.
The FBI’s CI/CD guidance also covered credential hygiene. Organisations were advised to store credentials in encrypted secrets management systems, avoid hardcoding credentials in code or configuration files, prefer temporary credentials over static credentials, and scan repositories and logs for exposed secrets.
To protect software artefacts, the FBI advised organisations to use automated integrity checks such as hashes and signatures before artefacts are published or deployed.
The agency also recommended maintaining trusted, access-controlled artefact repositories, monitoring for unauthorised changes, and keeping an inventory of third-party services connected to CI/CD pipelines. External services should have limited permissions, and integrations should be isolated or sandboxed where possible.
Logging should cover authentication events, configuration changes, artefact handling, failed login attempts, and suspicious activity across CI/CD systems. The FBI also advised organisations to maintain offline, immutable backups of critical repositories and package release artefacts.
(Photo by David Trinks)
See also: PolinRider supply chain attack expands to Packagist ecosystem
Want to learn more about cybersecurity from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events including the AI & Big Data Expo. Click here for more information.
Developer Tech News is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.