---
id: 6882
title: "KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/teampcp-attack-kics-github-action"
published_at: "2026-03-23T17:38:41Z"
tags: ["supply-chain", "github-actions", "incident", "checkmarx", "teampcp", "kics", "openvsx"]
phying_url: "https://phying.com/item/6882"
lang: en
---

# KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack

## Summary

TeamPCP hijacked the Checkmarx KICS GitHub Action on March 23, serving credential-stealing malware from 35 tags; OpenVSX extensions were hit too. Audit for docs-tpcp repos and checkmarx.zone C2.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2026-03-23T17:38:41Z
- **Original:** https://www.wiz.io/blog/teampcp-attack-kics-github-action
- **Phying News:** https://phying.com/item/6882