Date: 05/15/2026
Severity: High
Summary
Our research examined the April 22 Checkmarx KICS and April 24 elementary-data incidents as part of a broader TeamPCP supply chain campaign involving at least seven confirmed waves. The KICS attack used multichannel poisoning across Docker Hub, VS Code/OpenVSX, and GitHub Actions, later enabling the hijack of @bitwarden/cli through stolen npm tokens. The elementary-data compromise exploited GitHub Actions script injection, allowing attackers to abuse the project’s own CI pipeline to publish malicious packages to PyPI and GHCR. The campaign is designed for large-scale credential theft, targeting GitHub PATs, npm tokens, cloud and database credentials, SSH keys, Kubernetes secrets, IaC files, developer tooling secrets, and cryptocurrency wallet keystores. The incident also demonstrated that stolen maintainer credentials were unnecessary, as a single unsanitized pull request comment was enough to turn the project’s CI pipeline into the attacker’s release channel.
Indicators of Compromise (IOC) List
Domains/URLs : | audit.checkmarx.cx https://audit.checkmarx.cx/v1/telemetry https://api.github.com/search/commits?q=LongLiveTheResistanceAgainstMachines checkmarx.zone igotnofriendsonlineorirl-imgonnakmslmao.skyhanni.cloud https://litter.catbox.moe/iqesmbhukgd2c7hq.sh http://169.254.169.254/latest/meta-data/iam/security-credentials/ http://169.254.170.2 |
IP Address : | 94.154.172.43 83.142.209.203 91.195.240.123 188.114.96.3 |
Hash : | 24680027afadea90c7c713821e214b15cb6c922e67ac01109fb1edb3ee4741d9
2a6a35f06118ff7d61bfd36a5788557b695095e7c9a609b4a01956883f146f50
18f784b3bc9a0bcdcb1a8d7f51bc5f54323fc40cbd874119354ab609bef6e4cb
8605e365edf11160aad517c7d79a3b26b62290e5072ef97b102a01ddbb343f14
167ce57ef59a32a6a0ef4137785828077879092d7f83ddbc1755d6e69116e0ad
d37874c6c8a2d2a7a252810a1999ece8bb39e9b3ab2b7e8bf40da15bd36a1584
2588a44890263a8185bd5d9fadb6bc9220b60245dbcbc4da35e1b62a6f8c230d
222e6bfed0f3bb1937bf5e719a2342871ccd683ff1c0cb967c8e31ea58beaf7b
a0d9366f6f0166dcbf92fcdc98e1a03d2e6210e8d7e8573f74d50849130651a0
31ecc5939de6d24cf60c50d4ca26cf7a8c322db82a8ce4bd122ebd89cf634255
b3bbfafde1a0db3a4d47e70eb0eb2ca19daef4a19410154a71abee567b35d3d9
b1e4b1f3aad0d489ab0e9208031c67402bbb8480
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "igotnofriendsonlineorirl-imgonnakmslmao.skyhanni.cloud" or url like "igotnofriendsonlineorirl-imgonnakmslmao.skyhanni.cloud" or siteurl like "igotnofriendsonlineorirl-imgonnakmslmao.skyhanni.cloud" or domainname like "https://litter.catbox.moe/iqesmbhukgd2c7hq.sh" or url like "https://litter.catbox.moe/iqesmbhukgd2c7hq.sh" or siteurl like "https://litter.catbox.moe/iqesmbhukgd2c7hq.sh" or domainname like "checkmarx.zone" or url like "checkmarx.zone" or siteurl like "checkmarx.zone" or domainname like "http://169.254.169.254/latest/meta-data/iam/security-credentials/" or url like "http://169.254.169.254/latest/meta-data/iam/security-credentials/" or siteurl like "http://169.254.169.254/latest/meta-data/iam/security-credentials/" or domainname like "http://169.254.170.2" or url like "http://169.254.170.2" or siteurl like "http://169.254.170.2" or domainname like "audit.checkmarx.cx" or url like "audit.checkmarx.cx" or siteurl like "audit.checkmarx.cx" or domainname like "https://audit.checkmarx.cx/v1/telemetry" or url like "https://audit.checkmarx.cx/v1/telemetry" or siteurl like "https://audit.checkmarx.cx/v1/telemetry" or domainname like "https://api.github.com/search/commits?q=LongLiveTheResistanceAgainstMachines" or url like "https://api.github.com/search/commits?q=LongLiveTheResistanceAgainstMachines" or siteurl like "https://api.github.com/search/commits?q=LongLiveTheResistanceAgainstMachines" |
Detection Query 2 : | dstipaddress in ("188.114.96.3") or srcipaddress in ("188.114.96.3") |
Detection Query 3 : | sha256hash IN ("2a6a35f06118ff7d61bfd36a5788557b695095e7c9a609b4a01956883f146f50","d37874c6c8a2d2a7a252810a1999ece8bb39e9b3ab2b7e8bf40da15bd36a1584","18f784b3bc9a0bcdcb1a8d7f51bc5f54323fc40cbd874119354ab609bef6e4cb","24680027afadea90c7c713821e214b15cb6c922e67ac01109fb1edb3ee4741d9","8605e365edf11160aad517c7d79a3b26b62290e5072ef97b102a01ddbb343f14","167ce57ef59a32a6a0ef4137785828077879092d7f83ddbc1755d6e69116e0ad","2588a44890263a8185bd5d9fadb6bc9220b60245dbcbc4da35e1b62a6f8c230d","222e6bfed0f3bb1937bf5e719a2342871ccd683ff1c0cb967c8e31ea58beaf7b","a0d9366f6f0166dcbf92fcdc98e1a03d2e6210e8d7e8573f74d50849130651a0","31ecc5939de6d24cf60c50d4ca26cf7a8c322db82a8ce4bd122ebd89cf634255","b3bbfafde1a0db3a4d47e70eb0eb2ca19daef4a19410154a71abee567b35d3d9")
|
Detection Query 4 : | sha1hash in ("b1e4b1f3aad0d489ab0e9208031c67402bbb8480")
|
Reference:
https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html