TeamPCP: how Trivy, KICS, LiteLLM and axios broke CI/CD trust

Between 19 and 31 March 2026, a series of incidents demonstrated that a security tool running in CI/CD can become the most effective secret stealer in the environment. The campaign tracked as TeamPCP affected components around Trivy, Checkmarx KICS and LiteLLM, while the JavaScript ecosystem also faced compromised axios releases at the end of the month. The common factor was not language but the pipeline’s implicit trust in a tag, package and install hook.

GitLab’s incident summary says stolen credentials were used on 19 March to force-push malicious code into 76 of 77 aquasecurity/trivy-action tags and all seven aquasecurity/setup-trivy tags. Trojanised Trivy 0.69.4 also reached official distribution channels. Its payload collected environment variables, cloud tokens, SSH keys and pipeline secrets. The incident was assigned CVE-2026-33634.

Related KICS actions were affected on 23 March. Malicious LiteLLM 1.82.7 and 1.82.8 releases followed on 24 March. One payload executed during module import; the other used a .pth file processed by Python at interpreter startup. On 31 March compromised axios 1.14.1 and 0.30.4 releases introduced a malicious dependency and cross-platform RAT. Dates, versions and technical descriptions come from vendor communications and GitLab’s synthesis; responders should consult the latest advisory from each project.

Why a scanner can reach everything

A security job often runs early, scans the complete checkout, reads container images and publishes results. It receives repository and registry tokens, caches and sometimes cloud deployment credentials. Because teams see the scanner as a control, they may grant it more trust than an ordinary dependency.

A mutable GitHub Action reference such as uses: vendor/action@v1 is not a cryptographic identity. A maintainer — or an attacker holding their token — can move the tag. The pipeline downloads new code without a change or review in the user’s repository. A human-readable version and an immutable identifier are not the same control.

LiteLLM demonstrated a second path. Python installation can execute code outside an explicit application start. A .pth file in site-packages may contain an import statement processed during interpreter initialisation. “We never started the LiteLLM server” therefore does not exclude payload execution if Python ran after installation.

Determine pipeline exposure

Search repositories, reusable workflows, organisational templates and runner images for:

• tag-based aquasecurity/trivy-action and aquasecurity/setup-trivy references;
• Trivy 0.69.4–0.69.6 binaries and images as specified by current advisories;
• KICS actions used during the incident window;
• litellm==1.82.7 or 1.82.8 in lockfiles, caches and image layers;
• axios 1.14.1 or 0.30.4 and the malicious dependency described by the project;
• unknown .pth files containing import, exec, subprocess or networking;
• resolution or connections to lookalike domain models.litellm.cloud.

Fixing a manifest is not enough. Find every execution of the affected job and identify which secrets existed at that moment. A runner may expose organisational variables only on protected branches, cloud access through OIDC and additional credentials through files or helpers. Build a pipeline run → commit → runner → secrets → systems matrix.

Rotate CI/CD secrets correctly

If a malicious component executed, assume it exposed every secret available to the job. Rotation should be atomic: create and deploy the new credential, revoke the old one, then monitor use of both during the transition. Injecting a fresh token into a runner that is still compromised simply gives the actor the replacement.

A practical sequence:

1. pause affected pipelines and detach self-hosted runners;
2. preserve logs, caches, images and job metadata;
3. rebuild runners from a trusted, verified image;
4. remove malicious packages and pin corrected artefacts;
5. rotate repository, cloud, registry, SSH, signing and deployment credentials;
6. hunt target systems for old-token use;
7. resume only after negative egress and integrity tests.

Controls that break the pattern

Full SHA and digest pinning. GitHub Actions should use a complete commit, OCI images a sha256 digest, and downloaded binaries a verified checksum or signature. Keep the version tag only as a comment.

Short-lived identities. Cloud OIDC federation limits a stolen token’s lifetime when sub, repository, branch and audience conditions are narrow. A static access key in pipeline secrets has a much larger blast radius.

Default-deny egress. A scanner generally needs a small set of repositories and APIs. It should not reach the whole internet. DNS and egress proxy telemetry provides both prevention and evidence.

Ephemeral runners. One-shot runners reduce persistence but do not stop in-job theft. They still need a minimal identity, clean image and controlled cache.

Lockfile and pre-execution gates. Validate SRI hashes, new dependencies, .pth files, install scripts and package contents before execution. A scanner cannot be the sole verifier of its own integrity; enforcement needs another trust layer.

Long-term architecture

CI/CD is a production environment even when it only builds code. Separate build and deploy identities, sign artefacts, generate provenance, enforce SLSA, produce an SBOM and promote the same digest through environments. Updates to actions and tools require review, quarantine testing and publisher verification.

Extend your software supply-chain programme with Sigstore and SLSA, CI/CD workload identity and secrets management. To learn what a hostile job could extract today, BreachRoad can perform a controlled pipeline assessment.

---

Sources: GitLab — incident and pipeline-policy analysis, Aqua Security blog, CISA KEV, LiteLLM repository, axios repository. Verify incident-specific details against each project’s current advisory.