The TeamPCP attacks are a warning: Your CI/CD pipeline is the new front line

Attackers used stolen credentials to publish malicious Trivy releases and GitHub Actions, then distributed credential-stealing payloads via compromised packages on PyPI.

The incidents affected widely used packages including LiteLLM and Telnyx and follow earlier supply-chain compromises like tj-actions/changed-files.

CI/CD pipelines commonly hold high-value credentials and run third-party code with little scrutiny, making them attractive attack targets.

Recommended mitigations include removing long-lived static credentials, adopting short-lived OIDC identities, pinning and auditing dependencies, and enforcing branch protection, PR reviews, MFA, and commit signing.