Executive Summary
In March 2026, the threat actor group TeamPCP executed a sophisticated supply chain attack by compromising Checkmarx's GitHub Actions, specifically the 'ast-github-action' repository. The attackers injected credential-stealing malware into all 91 tags of the repository, from v0.1-alpha through v2.3.32, enabling unauthorized access to cloud services, GitHub repositories, and CI/CD pipelines of organizations utilizing these actions. This breach underscores the critical vulnerabilities present in software supply chains and the potential for widespread impact when trusted development tools are compromised.
This incident highlights the escalating trend of supply chain attacks targeting development infrastructure, emphasizing the necessity for organizations to implement stringent security measures within their CI/CD pipelines. The event also serves as a reminder of the importance of continuous monitoring and rapid response strategies to mitigate the risks associated with such sophisticated cyber threats.
Why This Matters Now
The Checkmarx supply chain attack by TeamPCP underscores the urgent need for organizations to secure their development pipelines against increasingly sophisticated threats targeting trusted tools and repositories. Immediate action is required to assess and fortify CI/CD environments to prevent similar breaches.
Attack Path Analysis
The TeamPCP supply chain attack began with the compromise of Checkmarx's GitHub Actions, leading to the insertion of credential-stealing malware across multiple versions. This allowed attackers to escalate privileges by harvesting sensitive credentials from CI/CD pipelines. Subsequently, they moved laterally by leveraging these credentials to access other systems and repositories. Command and control were established through persistent access to compromised environments. Data exfiltration occurred as attackers extracted sensitive information from affected systems. The impact included widespread exposure of secrets and potential for further supply chain compromises.
Kill Chain Progression
Initial Compromise
Description
Attackers compromised Checkmarx's GitHub Actions by injecting credential-stealing malware into multiple versions.
Related CVEs
CVE-2025-30066
CVSS 8.6A supply chain attack on the GitHub Action 'tj-actions/changed-files' led to the exposure of secrets in GitHub Actions Workflow logs.
Affected Products:
tj-actions changed-files – < 35.0.0
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Compromise Software Supply Chain
Unsecured Credentials: Credentials in Files
Valid Accounts
Command and Scripting Interpreter: Unix Shell
Obfuscated Files or Information
Archive Collected Data: Archive via Utility
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure the integrity of software and firmware
Control ID: 6.2.3
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Data
Control ID: Pillar 3
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Critical exposure through compromised development tools including Checkmarx, Trivy, and LiteLLM affecting CI/CD pipelines, requiring immediate credential rotation and supply chain security review.
Computer/Network Security
Security vendors directly targeted by TeamPCP campaign, with tools becoming attack vectors themselves, undermining trust in security infrastructure and requiring comprehensive tool validation.
Financial Services
High-value target for credential theft via compromised security scanning tools, facing regulatory compliance risks under PCI DSS and potential data exfiltration through poisoned dependencies.
Health Care / Life Sciences
HIPAA compliance violations possible through compromised development environments, with stolen credentials potentially exposing patient data and violating multiple regulatory frameworks including encryption requirements.
Sources
- TeamPCP Supply Chain Campaign: Update 001 - Checkmarx Scope Wider Than Reported, CISA KEV Entry, and Detection Tools Available, (Thu, Mar 26th)https://isc.sans.edu/diary/rss/32834Verified
- Compromised GitHub Actions Leading to Credential Leakshttps://checkmarx.com/zero-post/compromised-github-actions-leading-to-credential-leaks/Verified
- Attack on DevOps: secrets leaked via malicious GitHub Actionhttps://me-en.kaspersky.com/blog/malicious-github-action-changed-files/23912/Verified
- GitHub Actions supply chain attack spotlights CI/CD riskshttps://www.techtarget.com/searchITOperations/news/366621078/GitHub-Actions-supply-chain-attack-spotlights-CI-CD-risksVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have constrained the attacker's ability to escalate privileges, move laterally, and exfiltrate data by enforcing strict segmentation and identity-aware policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The initial compromise may have been detected earlier, potentially limiting the attacker's ability to escalate privileges.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges could have been constrained by limiting access to sensitive credentials.
Control: East-West Traffic Security
Mitigation: The attacker's lateral movement within the network would likely have been limited, reducing the scope of the breach.
Control: Multicloud Visibility & Control
Mitigation: The establishment of persistent access by attackers could have been detected and constrained, reducing their ability to maintain control.
Control: Egress Security & Policy Enforcement
Mitigation: The exfiltration of sensitive data would likely have been limited, reducing the amount of data transmitted to external servers.
The overall impact of the attack would likely have been reduced, limiting the exposure of secrets and mitigating further supply chain risks.
Impact at a Glance
Affected Business Functions
- CI/CD Pipelines
- Source Code Management
Estimated downtime: 7 days
Estimated loss: $50,000
Exposure of CI/CD secrets and credentials, potentially leading to unauthorized access to source code repositories.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict lateral movement within the network.
- • Enforce Egress Security & Policy Enforcement to monitor and control outbound traffic.
- • Deploy Threat Detection & Anomaly Response systems to identify and respond to suspicious activities.
- • Utilize Multicloud Visibility & Control to maintain oversight across all cloud environments.
- • Regularly audit and rotate credentials to mitigate the risk of compromised secrets.
