Skip to content

// #docker

1 article

← All tags
💻 AppSec

TeamPCP Supply Chain Campaign Expands to npm and Docker Hub — Bitwarden CLI and Checkmarx KICS Both Backdoored

The TeamPCP supply chain threat group has extended its campaign beyond GitHub Actions and PyPI to poison the @bitwarden/cli npm package and overwrite Checkmarx KICS Docker images and VS Code extensions. The campaign now spans four developer distribution channels across six weeks, deploying a self-propagating worm that exfiltrates SSH keys, cloud credentials, and MCP configuration files from compromised developer environments.

#supply-chain +7

Commentary tagged #docker

Opinion

TeamPCP Has Now Hit Every Developer Distribution Channel. The Pipeline Is the Perimeter.

In six weeks, one supply chain threat group has successfully backdoored GitHub Actions, PyPI, npm, Docker Hub, and the VS Code Marketplace. The security industry's response has been to treat each incident as a separate patching problem. It isn't. It's a systematic demonstration that the developer distribution stack has no defence-in-depth, and that the security controls the industry has built — SCA, SBOM, SAST — operate at entirely the wrong layer.

CipherWatch Editorial

Security Intelligence Platform