Software supply chain attacks compromise the tools and dependencies organizations already trust, from vulnerability scanners and LLM gateways to telecom SDKs and HTTP clients. These articles cover the TeamPCP campaign that began with the Trivy compromise and cascaded through LiteLLM, Telnyx, and related ecosystems, alongside the parallel axios npm incident and the spring 2026 escalation into IDE extensions and self-spreading worms. Each piece focuses on concrete timelines, indicators of compromise, blast-radius assessment, and remediation steps security teams can execute immediately. The through-line is practical: when a trusted package or pipeline is poisoned, the question is not only which versions were malicious, but what a stolen token can actually reach next — and how continuous validation helps answer that before an attacker does.
5 articles
In March, TeamPCP turned trusted security tools into weapons. It did not stop there. Across April, May, and June 2026 the campaign breached GitHub itself, poisoned a VS Code extension to steal AI assistant credentials, open-sourced its own worm, and spawned ecosystem-wide copycats. Here is the full timeline, the IOCs, and what to do now.
On March 31, 2026, an attacker hijacked the lead axios maintainer's npm account and published two malicious versions — axios@1.14.1 and axios@0.30.4 — injecting a cross-platform remote access trojan via a fake dependency. Here is the full timeline, technical analysis, IOCs, and what to do if you are affected.
The telnyx Python package was compromised on PyPI this morning. It is the fifth target in a supply chain campaign that has now crossed from vulnerability scanners to CI/CD pipelines to LLM gateways to telecom SDKs in nine days. Here is everything we know, every IOC, and exactly what to do if you are affected.
The Trivy supply chain attack in March 2026 compromised one of the most trusted open-source security scanners, cascading through GitHub Actions, Docker Hub, and downstream projects including Checkmarx KICS and LiteLLM. Here is the full timeline, what was affected, and how to respond.
LiteLLM's March 2026 vulnerability was a critical PyPI supply chain compromise affecting versions 1.82.7 and 1.82.8. Learn what happened, who was affected, and how to respond.
See how Revaizor can transform your security testing.
Request Early Access