TeamPCP stole about 3,800 GitHub repos via poisoned developer tools
Original title: TeamPCP Hackers Steal 3,800 GitHub Repositories by Poisoning Trivy, LiteLLM, and VS Code Extensions
GitHub says customer-owned repositories were not accessed, but some stolen internal repos held customer support excerpts.
TeamPCP’s supply-chain campaign ended with theft of about 3,800 GitHub internal repositories after a poisoned VS Code extension compromised an employee device on May 18. Aqua Security traced a late February intrusion to a misconfigured GitHub Actions environment; incomplete credential rotation let attackers poison Trivy release automation rather than exploit Trivy’s scanner. Malicious LiteLLM releases and Nx Console 18.95.0 followed, harvesting developer and cloud secrets. GitHub removed the extension build, isolated the device, and rotated secrets, and later required a GitHub Enterprise Server signing-key update.
Unconfirmed: GitHub called the 3,800-repository figure directionally consistent and reported no evidence of access to customer-owned repositories.
- Malicious Trivy 0.69.4 was published and 76 of 77 trivy-action tags were redirected.
- LiteLLM 1.82.8 added a malicious .pth file that runs at Python startup.
- Nx Console had more than 2.2 million installations across versions.
- Payloads searched 50-plus locations and could exfiltrate via HTTPS, GitHub API, or DNS tunneling.
Impact: Internal repository theft and developer, cloud, and CI secrets stolen
| Product | Affected |
|---|---|
| Aqua Security Trivy | malicious 0.69.4 |
| LiteLLM | 1.82.7 and 1.82.8 |
| Nx Console | 18.95.0 |
| Aqua Security trivy-action | 76 of 77 version tags redirected |
- 1.Revoke exposed credentials and rebuild compromised runners or endpoints.
- 2.Pin GitHub Actions to verified full commit hashes.
- 3.Update trusted public keys before installing later GitHub Enterprise Server releases.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1552.001 Credentials In FilesT1567.001 Exfiltration to Code RepositoryT1071.004 Application Layer Protocol: DNST1078 Valid Accounts
- Vendors
- GitHubAqua Security
- Threat actors
- TeamPCP
- Victims
- GitHub
- Organizations
- Blackfog
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | scan.aquasecurtiy.org | ensitive material. Collected data was encrypted and sent to scan.aquasecurtiy.org, a domain impersonating Aqua Security. Where suitable GitHu |
From the original article
3 min read at gbhackers.com
TeamPCP’s escalating software supply chain campaign culminated in the theft of approximately 3,800 GitHub internal repositories after a poisoned VS Code extension compromised an employee’s device. GitHub described the attackers’ repository count as “directionally consistent” with its investigation, while reporting no evidence that customer-owned repositories were affected.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.