The Security Scanner Was the Attack Vector. 10,000 CI/CD Workflows Compromised.

A security scanner. The tool your team trusts to find vulnerabilities. That was the entry point.

The TeamPCP campaign compromised Aqua Security's Trivy scanner (a GitHub Action used in CI/CD pipelines), then used that foothold to backdoor LiteLLM's CI/CD pipeline, then pivoted to Checkmarx KICS. The attack chain is almost elegant in how it exploits trust hierarchies: developers pin their application dependencies but treat security scanning tools as implicitly trusted. The attackers went after exactly that assumption.

On March 19, attacker "TeamPCP" force-pushed 75 of 76 tags on the trivy-action GitHub Action with malicious binaries that exfiltrated AWS, GCP, and Azure credentials, SSH keys, and Kubernetes tokens from approximately 10,000 GitHub workflows. This was the second compromise in March. The first happened March 1, and the root cause was incomplete credential rotation after that first incident. They didn't rotate everything. The attackers came back through the gap.

Callum McMahon published a minute-by-minute transcript (highlighted by Simon Willison) of using Claude to analyze the backdoored LiteLLM package in real time during the incident, tracing the base64-encoded payload and identifying exfiltration targets. The irony of using an AI coding tool to analyze a supply chain attack that was itself enabled by security tooling isn't lost on me.

A Datadog DevSecOps report revealed that 71% of organizations never pin GitHub Actions to commit hashes. That means nearly three-quarters of CI/CD pipelines are vulnerable to exactly this type of tag-mutation attack right now.

GitHub responded. Their 2026 Actions security roadmap introduces a new dependencies: section in workflow YAML that locks all direct and transitive dependencies by commit SHA, similar to how go.mod and go.sum work. It's the right architectural response. But it's not shipped yet.

For builders: do this today. Pin every GitHub Action in your workflows to a full commit SHA, not a version tag. Replace uses: aquasecurity/[redacted] with uses: aquasecurity/trivy-action@<full-sha>. It takes 20 minutes and it closes the exact attack vector that hit 10,000 pipelines this month. If you're using MCP servers, CI/CD tools, or coding agents that install dependencies, treat every dependency as untrusted code, because after this week, that's exactly what it is.