The AI Supply Chain Is Now Critical Infrastructure: Lessons from the TeamPCP Campaign That Hit Trivy, Checkmarx, and LiteLLM
In the span of five days in March 2026, a single threat actor—TeamPCP—compromised a vulnerability scanner (Trivy), a code analysis platform (Checkmarx), and the most widely used LLM proxy in the Python ecosystem (LiteLLM). The attack chain was surgical: each compromised tool provided credentials to attack the next target.