- 24th March 2026
In five days, a single stolen GitHub token became a cascading supply chain compromise spanning Trivy, Checkmarx, OpenVSX, and npm. TeamPCP force-pushed 110+ malicious tags, backdoored container images, weaponised VS Code extensions against local coding agents, and launched a self-propagating npm worm using blockchain C2. If your CI/CD pipelines reference any of these tools by version tag, assume compromise.
Francesco Cipollone