The TeamPCP Attack: How One Stolen Token Compromised Trivy, LiteLLM, and 47 npm Packages — What Every Developer Must Do Now

On March 26, 2026, security researchers at Socket.dev flagged anomalous publishing activity across dozens of npm packages. Within hours, the scope of the incident became clear: a threat actor operating under the handle TeamPCP had compromised a single automation token belonging to a widely-trusted open-source maintainer and used it to inject credential-harvesting code into 47 npm packages, the Trivy container security scanner’s official npm integration, and a malicious clone of the LiteLLM Python proxy that was pushed to PyPI.

The attack is now considered one of the most sophisticated supply chain compromises of 2026 — not because of the malware payload, which was relatively straightforward, but because of the cascade strategy the attacker used to maximize blast radius from a single point of entry.

This post breaks down exactly what happened, how to determine whether your systems were affected, and the concrete steps every development team should take to harden their CI/CD pipeline against this class of attack.

Try it yourself: Free Hash Generator — free, no signup, runs in your browser.

Timeline of the TeamPCP Attack

Understanding the sequence of events is critical for assessing your exposure window.

March 22 — Token Compromise

The initial compromise occurred when a maintainer of several popular npm utility packages had their GitHub personal access token (PAT) stolen. The token was embedded in a CI configuration file within a private repository. The attacker gained access to the private repository through a compromised GitHub OAuth app that the maintainer had authorized months earlier for a code review tool that had since been abandoned by its developer.

March 23 — Reconnaissance and Lateral Movement

TeamPCP used the stolen PAT to enumerate all repositories accessible to the maintainer. They identified npm publish automation workflows in 47 packages across 12 organizations where the maintainer had contributor access. They also identified the maintainer’s role as a release manager for trivy-npm, the official npm wrapper for Aqua Security’s Trivy scanner.

March 24 — First Malicious Publishes

Between 02:00 and 06:00 UTC, TeamPCP triggered automated publish workflows for 34 of the 47 targeted npm packages, injecting a small obfuscated payload into the postinstall script of each package. The payload collected environment variables — including NPM_TOKEN, AWS_ACCESS_KEY_ID, GITHUB_TOKEN, and any variable matching common cloud credential patterns — and exfiltrated them to an attacker-controlled endpoint disguised as a telemetry service.

March 24 — Trivy npm Wrapper Compromised

At 14:30 UTC the same day, TeamPCP published a modified version of [email protected]. This version contained a pre-scan hook that exfiltrated the contents of any .env files, Docker socket paths, and Kubernetes service account tokens found in the scanned directory. The irony was devastating: teams running Trivy to check for vulnerabilities were actively being compromised by the security tool itself.

March 25 — LiteLLM PyPI Package

Using credentials harvested from the first wave of compromised npm packages, TeamPCP published litellm-proxy (note the hyphen) to PyPI — a typosquatted package mimicking the legitimate litellm library. The malicious package functioned as a working LiteLLM proxy but included a background thread that intercepted all API keys passed through the proxy and forwarded them to the attacker’s command-and-control infrastructure. Teams using litellm-proxy to manage their LLM API routing unknowingly handed over their OpenAI, Anthropic, and Azure API keys.

March 26 — Detection and Response

Socket.dev’s automated analysis flagged the anomalous npm publishes at 09:15 UTC. By 13:00 UTC, npm had yanked all 47 compromised package versions. PyPI removed litellm-proxy at 15:40 UTC. Aqua Security published an emergency advisory for Trivy at 16:00 UTC, confirming that only the npm wrapper was affected — the core Trivy binary distributed via GitHub Releases and container images was not compromised.

March 27 — Full Disclosure

Socket.dev, Aqua Security, and the affected npm maintainer published a coordinated disclosure with indicators of compromise (IOCs), affected package versions, and remediation guidance.

How the Cascade Strategy Worked

What makes the TeamPCP attack distinct from typical supply chain compromises is the deliberate cascade design. The attacker did not simply inject malware into packages — they used each stage of the attack to harvest credentials that enabled the next stage.

The chain operated as follows:

1. Stage 1: Stolen PAT provides access to npm publish workflows
2. Stage 2: Compromised npm packages harvest cloud credentials and additional tokens from CI environments
3. Stage 3: Harvested credentials are used to publish the malicious PyPI package and potentially access cloud infrastructure
4. Stage 4: The compromised Trivy wrapper targets security-conscious teams who are most likely to have access to production infrastructure and sensitive credentials

Each stage expanded the attacker’s reach by targeting a different trust boundary. npm packages compromise JavaScript developers. The Trivy wrapper compromises security engineers. The LiteLLM clone compromises AI/ML teams managing API routing. By the time detection occurred, the attacker had potentially harvested credentials spanning three distinct organizational functions — frontend development, security operations, and AI infrastructure.