Topic starter
06/07/2026 9:42 am
TL;DR: TeamPCP compromised four open-source tools in nine days, then harvested cloud credentials, SSH keys, Kubernetes configs, and CI/CD secrets from trusted developer workflows, according to Oligo Security. The campaign shows that supply chain compromise now turns on runtime trust and speed, not just malicious code placement.
Editorial analysis by NHI Mgmt Group, based on content published by Oligo Security: “TeamPCP Campaign: The Evolution of Modern Supply Chain Attacks”.
Key questions
Q: What happens when a trusted CI/CD workflow is compromised through a malicious or broken action?
A: A compromised workflow can exfiltrate secrets, tamper with build outputs, or propagate bad code through downstream releases before the issue is detected.
A: CI/CD environments amplify risk because they sit upstream of many systems and can distribute malicious code, artifacts, or credentials at scale.
Q: What are the signs that a CI/CD pipeline is being abused through living-off-the-pipeline techniques?
A: Warning signs include unexpected plugin execution, tools reading configuration from the wrong location, unexplained dependency changes, unusual shell behaviour from environment variables, and secrets appearing in logs or standard output.
Practitioner guidance
- Map CI/CD workflow identities Inventory every runner, action, package hook, and build step that can read cloud tokens, repository secrets, or deployment credentials.
- Isolate secret-accessing build steps Split secret-reading steps from ordinary builds so package installation, scanning, and deployment do not share the same trust boundary.
- Add runtime secret-use detection Alert when a package, workflow, or runner begins reading credential files, calling metadata services, enumerating IAM resources, or cloning repositories in bulk.
Bottom line: This campaign shows that supply chain compromise in CI/CD is really a delegated-access problem, because trusted workflows can expose the same secrets that attackers want.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:58 am
CI/CD trust has become the new supply chain attack surface: The important control boundary is no longer only the package registry or source repository. It is the privileged execution context where workflows can read secrets, assume cloud roles, and interact with deployment systems. That means a compromised tool can matter more than a compromised artifact because it runs where the real credentials live. Practitioners should treat workflow trust as an access-control problem, not just a software integrity problem.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should security teams respond when a secret is exposed in code or logs?
A: Start by identifying what the secret can access, not by rotating it immediately. Then isolate affected systems, revoke the credential, update dependent configurations, and verify the replacement works. A safe response sequence depends on blast radius, because the same secret may unlock multiple services or environments.
👉 Read our full editorial: TeamPCP shows how supply chain attacks now target CI/CD trust