Minacce · 155 giorni fa

Developer Tooling Compromises Return Across npm, PyPI, and Docker

Developer supply chains are back in the crosshairs. TeamPCP has shifted from credential monetization back to active compromise, and the risk is not just one poisoned package. A compromise in one trusted build or dependency path can now cascade into other developer tools and downstream pipelines.

The week brought three concurrent compromises across npm, PyPI, and Docker Hub. Checkmarx KICS was compromised on April 22, xinference on PyPI was poisoned the same day, and a self-propagating npm worm called CanisterSprawl was identified beginning April 21. The KICS Docker compromise then cascaded into @bitwarden/cli version 2026.4.0 through Bitwarden’s CI/CD automation, and the campaign also remains tied to CVE-2026-33634.

The forward risk is persistence, not novelty. TeamPCP appears to have retained full operational capability after a 26-day pause, and the pattern now favors developer tooling as the fastest way to amplify downstream impact across software supply chains.

CVE-2026-33634

NVD KEV

Sfruttamento noto · CISA KEV

Data di correzione federale CISA 9 apr · data superata

Cronologia

27 apr Segnalato da SANS ISC
9 apr Scadenza federale CISA per CVE-2026-33634 superata
26 mar CVE-2026-33634 aggiunto al KEV CISA

Fonti

1 fonte che coprono questa storia

SANS ISC 27 apr
TeamPCP Supply Chain Campaign: Update 008 - 26-Day Pause Ends with Three Concurrent Compromises (Checkmarx KICS, Bitwarden CLI Cascade, xinference PyPI), CanisterSprawl npm Worm Identified, and Tier 1 Coverage Returns
TeamPCP Supply Chain Campaign: Update 008 - 26-Day Pause Ends with Three Concurrent Compromises (Checkmarx KICS, Bitwarden CLI Cascade, xinference PyPI), CanisterSprawl npm Worm Identified, and Tier 1 Coverage Returns, Author: Kenneth Hartman

Entità

CVE-2026-33634
TeamPCP

Part of the PlainSec briefing for 2026-04-28

Editions

Storie correlate

Minacce · 155 giorni faDeveloper Tooling Compromises Return Across npm, PyPI, and DockerDeveloper supply chains are back in the crosshairs. TeamPCP has shifted from credential monetization back to active compromise, and the risk is not just one poisoned package. A compromise in one trusted build or dependency path can now cascade into other developer tools and downstream pipelines.The week brought three concurrent compromises across npm, PyPI, and Docker Hub. Checkmarx KICS was compromised on April 22, xinference on PyPI was poisoned the same day, and a self-propagating npm worm called CanisterSprawl was identified beginning April 21. The KICS Docker compromise then cascaded into @bitwarden/cli version 2026.4.0 through Bitwarden’s CI/CD automation, and the campaign also remains tied to CVE-2026-33634.The forward risk is persistence, not novelty. TeamPCP appears to have retained full operational capability after a 26-day pause, and the pattern now favors developer tooling as the fastest way to amplify downstream impact across software supply chains.