Pre-Beta Pre-beta signups are open now. The full audytx engine is live for pre-beta. Everything free today stays free — paid tiers arrive Sep 01, 2026 from $20/month for unlimited repositories.
← Notes Security · June 30, 2026

Why the TeamPCP supply-chain attack couldn't touch audytx

TeamPCP poisoned trusted GitHub Actions to steal CI credentials from the pipelines that ran them. audytx never runs as a GitHub Action — it's a hosted webhook that scans Terraform on its own infrastructure — so that entire attack class has nothing to execute.

GitHub Action tag-poisoning steals your CI credentials audytx = hosted webhook no action in your pipeline nothing to poison
9.4
CVSS score — CVE-2026-33634
~1,000
enterprise environments hit
2
trusted scanner Actions poisoned
0
audytx surface the attack could reach
The attack

Tag-poisoning, weaponized

In March 2026, a threat actor called TeamPCP force-pushed malicious version tags onto two popular security scanners — aquasecurity/trivy-action and Checkmarx/kics-github-action — turning trusted, “immutable”-looking steps into credential stealers inside thousands of pipelines (CVE-2026-33634).

Tag force-pushed

A version tag like @v0.x is mutable, so the attacker rewrote the code behind a name teams already trusted.

Runner executes it

uses: aquasecurity/trivy-action@v0.x runs that code with your pipeline's credentials, on your runner.

Credentials stolen

The stealer scraped GitHub tokens, AWS IAM keys, GCP and Azure secrets from process memory, then exfiltrated them.

Scanning didn't save anyone. Static analysis and dependency scanning missed it because the malicious code lived inside a trusted, signed action — and the only real mitigation was to pin actions to full commit SHAs, because tags can be force-pushed and SHAs can't.

The architecture

A webhook, not a workflow

audytx is a GitHub App backed by a hosted webhook — it never runs in your CI. GitHub sends a webhook when a pull request opens; audytx fetches and analyzes the Terraform on its own infrastructure and posts the comment back.

no audytx action to add no tag to pin no third-party step on your runner no CI secrets within reach

The attack surface TeamPCP exploited simply doesn't exist here. A webhook can't poison your pipeline.

For what audytx stores and how, see the trust page.

Honest scope

Exactly one class, gone

This immunity is specific — the GitHub-Action tag-poisoning class, not every supply-chain risk. No software is free of all of them, and we take our own dependencies and infrastructure seriously.

What's gone, specifically, is the exact thing TeamPCP weaponized: a trusted third-party step executing inside your CI with your credentials. That step never exists in the audytx path.

audytx's optional plan-upload enrichment does run inside your own GitHub Actions workflow, authenticated over short-lived OIDC instead of a shared secret. But it's your workflow and your code — not a pinned third-party action someone else can force-push out from under you.

Regardless of us

Harden your pipeline anyway

Whether or not you use audytx, the TeamPCP playbook has three durable countermeasures. Do all three.

Pin to full SHAs

Pin every GitHub Action to a full commit SHA instead of a version tag — SHAs can't be force-pushed.

Rotate exposed creds

Rotate any credentials that could have been exposed during the TeamPCP windows.

Kill long-lived secrets

Skip tooling that needs long-lived secrets sitting in your runner; prefer short-lived OIDC.

The detailed incident write-ups from Arctic Wolf and Microsoft are worth reading in full.

Open beta

Start free during the open beta

If you're re-evaluating your CI scanners after TeamPCP, the architecture matters as much as the check count — and there's nothing in your pipeline to poison.