AI Toolchain Supply-Chain Compromise
The 2026 pattern of attacking the AI stack through its build/distribution chain: the TeamPCP campaign (poisoned Trivy CI actions → CanisterWorm on npm → hijacked KICS/Docker Hub → trojaned LiteLLM 1.82.7/1.82.8 on PyPI, CVE-2026-33634 CVSS 9.4), with `.pth`-based persistence that survives package uninstall.
Summary
The 2026 pattern of attacking the AI stack through its build/distribution chain: the TeamPCP campaign (poisoned Trivy CI actions → CanisterWorm on npm → hijacked KICS/Docker Hub → trojaned LiteLLM 1.82.7/1.82.8 on PyPI, CVE-2026-33634 CVSS 9.4), with `.pth`-based persistence that survives package uninstall.
The supply-side sibling of the MCP-runtime injection pain points — malicious *code* upstream rather than malicious *content* at retrieval time. AI middleware (routers, gateways, memory SDKs, MCP servers) concentrates credentials, making it the chain's highest-value target; OWASP MCP Top 10 classifies the class as MCP04.
Definition
The 2026 pattern of attackers compromising the AI stack through its build and distribution chain rather than its runtime: poisoned security scanners in CI (Aqua Trivy's GitHub Actions), a self-propagating package worm (CanisterWorm on npm), hijacked container registries, and trojaned releases of AI middleware (LiteLLM 1.82.7/1.82.8 on PyPI — CVE-2026-33634, CVSS 9.4). The layers that concentrate AI traffic — routers, gateways, memory SDKs, MCP servers — concentrate credentials, which makes them the highest-value targets in the chain.
Recent developments
- The TeamPCP campaign is the reference incident. Entry via Aqua Trivy's compromised GitHub Actions in early March 2026; publishing credentials harvested from downstream CI; CanisterWorm seeded across npm; Checkmarx KICS and Docker Hub images hijacked; LiteLLM 1.82.7/1.82.8 published to PyPI on March 24. Tracked as CVE-2026-33634 (CVSS 9.4). Per Trend Micro — inside the LiteLLM compromise, Unit 42 — TeamPCP, and SANS — when the security scanner became the weapon.
- Remediation consensus is environment destruction, not package removal. Because the payload persists via
site-packages.pthexecution, guidance is to destroy affected environments, rotate all cloud and AI-provider keys, and pin CI dependencies to immutable SHA hashes. Per Averlon — responding to CVE-2026-33634. - The retrieval-side siblings. The GitHub MCP server prompt-injection disclosure (May 2025) and the Mem0 SDK injection vulnerability (May 2026) attack the same trust boundary from the data side — malicious content, rather than malicious code, hijacking the agent — and the industry still lacks a standard protocol for sanitizing MCP tool output before it enters an LLM's context window. Per Lenses.io — productionising MCP servers.
Connections 4
Outbound 4
Resources 3
The definitive incident anatomy of the TeamPCP campaign — the Trivy entry vector, cross-ecosystem propagation, and the LiteLLM payload's persistence mechanism.
Unit 42's independent tracking of the multi-stage campaign — corroborates scope across GitHub Actions, npm, Docker Hub, and PyPI.
The practical remediation guidance — why uninstalling is insufficient and environment destruction plus key rotation is the floor.