In March 2026, a supply chain attack campaign dubbed TeamPCP compromised some of the most widely used Python packages in AI development environments. The operation targeted Trivy, LiteLLM, and the Telnyx SDK, exploiting stolen CI/CD credentials to push malicious versions to PyPI. The fallout extends well beyond individual developers — it strikes at the heart of enterprise cloud infrastructure security.
The TeamPCP Campaign: Anatomy of a Cascading Attack
How the Chain Compromise Works
TeamPCP operated through a multi-stage, incremental approach. The attackers first compromised Trivy, Aqua Security’s open-source vulnerability scanner, then leveraged the stolen publishing tokens to poison subsequent releases. As a result, LiteLLM and the Telnyx Python SDK were distributed with malicious payloads directly through PyPI.
The technique is elegant in its brutality. There is no need to breach the final target directly — compromising a trusted upstream project is enough.
The deployed payloads carried concrete and dangerous capabilities:
- Cloud credential theft (AWS, GCP, Azure)
- SSH key exfiltration
- Kubernetes secrets harvesting
- Remote code execution on developer systems
Palo Alto Networks and the Cloud Security Alliance independently documented the same operation, confirming the coordinated nature of the attack.
Who Is TeamPCP?
TeamPCP was first identified in 2026 and does not yet carry the established track record of major APT groups. Nevertheless, the sophistication of this campaign points to mature technical capabilities. The group demonstrates a deep understanding of CI/CD pipelines and open-source packaging ecosystems.
A Systemic Trend: Python Supply Chain Attacks in 2026
An Ecosystem Under Siege
TeamPCP is far from an isolated incident. 2026 has seen a wave of supply chain attacks targeting the Python ecosystem and AI/ML tooling, each following the same recurring pattern.
What makes this particularly alarming is that these attacks are zeroing in on AI development environments — environments that hold privileged access to cloud credentials, models, datasets, and critical infrastructure. They are, by any measure, high-value targets.
Among the most significant incidents of recent months:
- May 2026: Microsoft’s
durabletaskpackage is compromised on PyPI. The payloads steal credentials and move laterally across cloud infrastructure. - June 2026: The Hades campaign poisons multiple PyPI packages, exfiltrating GitHub tokens, cloud credentials, SSH keys, and CI/CD secrets.
- April 2026: PyTorch Lightning is compromised, with malicious versions used once again for credential theft.
In every case, the attack vector is identical: a maintainer account or automated release workflow is taken over, resulting in malicious versions that execute harmful code at install or import time.
Why AI Tools Are Prime Targets
There is a structural reason worth emphasizing. Packages used by ML and platform engineering teams frequently carry broad permissions — access to S3 buckets, inference endpoints, container registries, and training pipelines. Compromising a single dependency can unlock an entire ecosystem.
As a result, Python package security is no longer a niche technical concern. It has become a governance priority for CISOs and IT leadership alike.
How to Defend Yourself: Practical Controls for Security Teams
Securing the Publishing Pipeline
The first line of defense involves publishing tokens. Many of these attacks were made possible by long-lived, poorly managed PyPI tokens. The most effective solution is to adopt OIDC-based Trusted Publishing, which eliminates the need for static tokens in CI/CD workflows.
In parallel, security teams should:
- Pin package versions and verify their cryptographic hashes
- Monitor anomalous releases that do not match expected source tags
- Restrict outbound access from build runners to prevent data exfiltration
Containing Secrets and Reducing Privilege
In this threat landscape, secrets management becomes critical. Teams should:
- Rotate credentials immediately following any incident or suspicion of compromise
- Use separate publishing identities for each maintained package
- Apply the principle of least privilege to all automation accounts
Yet the most underrated measure remains centralized monitoring. Detecting anomalous changes in packaging workflows, token usage, and published releases makes it possible to catch compromises before they reach end users.
For AI/ML teams specifically, it is advisable to maintain explicit allowlists of approved packages and conduct systematic inspections of install-time behavior.
Sources
- Cloud Security Alliance – CSA Research Note: AI/ML PyPI Supply Chain Attack TeamPCP
- Palo Alto Networks Unit 42 – TeamPCP Supply Chain Attacks
- CSO Online – Python Package Security in 2026
Source: Original article
The TeamPCP campaign underscores how critical timely threat intelligence sharing is among organizations that rely on the same open-source dependencies. Platforms like IsacChain enable the secure, verified sharing of indicators of compromise linked to supply chain attacks, while also supporting the automated NIS2 compliance requirements that critical infrastructure operators must meet. Integrated blockchain verification ensures the integrity and provenance of shared information, reducing the risk of disinformation in coordinated attack scenarios like TeamPCP. Discover how IsacChain can help your organization at www.isacchain.com