CI/CD Security

In March, TeamPCP turned trusted security tools into weapons. It did not stop there. Across April, May, and June 2026 the campaign breached GitHub itself, poisoned a VS Code extension to steal AI assistant credentials, open-sourced its own worm, and spawned ecosystem-wide copycats. Here is the full timeline, the IOCs, and what to do now.

The telnyx Python package was compromised on PyPI this morning. It is the fifth target in a supply chain campaign that has now crossed from vulnerability scanners to CI/CD pipelines to LLM gateways to telecom SDKs in nine days. Here is everything we know, every IOC, and exactly what to do if you are affected.

The Trivy supply chain attack in March 2026 compromised one of the most trusted open-source security scanners, cascading through GitHub Actions, Docker Hub, and downstream projects including Checkmarx KICS and LiteLLM. Here is the full timeline, what was affected, and how to respond.