When the Scanner Is the Attacker: A Supply-Chain Cascade Through the ML Pipeline
In March 2026, a group called TeamPCP ran a five-day cascade that weaponized the very tools we trust to catch supply-chain attacks. It began by compromising Trivy — a container scanner running in millions of CI pipelines — and used the credentials it harvested to fund the next hop, and the next, until it reached PyPI and backdoored LiteLLM, the gateway through which 100+ LLM APIs are called. This session follows that one campaign end to end: the exact artifacts — a force-pushed Action tag, a poisoned litellm release, a .pth file that re-executes on every Python invocation and survives uninstall — the credentials stolen at each stage, and how the attack rode CI/CD straight toward production. Then we run it backward: at each hop we place the single control that breaks the chain — SHA-pinned actions, ephemeral egress-filtered runners, OIDC hardening, hash-pinned installs, provenance verification, and a sandboxed behavioral gate — and show why a pipeline that regulates itself as a closed control loop is what keeps a poisoned package out of prod. Live demo: a poisoned pip install steals a mock OIDC token in CI, then provenance verification and egress lockdown stop it cold.
Agenda:
Session outline
The hook — The scanner is the attacker. Threat model in one line: CI/CD is the actuator that holds production’s credentials.
The beachhead: Trivy — Tag force-push, CVE-2026-33634, and why a security scanner has god-mode in your pipeline.
The cascade — Each hop funds the next: OIDC theft, Runner.Worker memory extraction, worm propagation → into PyPI (LiteLLM 1.82.7/1.82.8). The self-funding chain.
Payload & blast radius — Credential harvesting, AES-GCM exfil, the .pth persistence that survives uninstall, K8s lateral movement. Why “remove the package” doesn’t help.
The gates — Break the chain hop by hop, each gate named with its tool. The heart of the talk.
Live demo — Poisoned pip install steals a mock OIDC token in a throwaway CI job; provenance verification + egress lockdown block it, a clean pinned install passes.
Virtual: https://events.vtools.ieee.org/m/572672
