Why the TeamPCP supply-chain attack couldn't touch audytx
TeamPCP poisoned trusted GitHub Actions to steal CI credentials from the pipelines that ran them. audytx never runs as a GitHub Action — it's a hosted webhook that scans Terraform on its own infrastructure — so that entire attack class has nothing to execute.
Tag-poisoning, weaponized
In March 2026, a threat actor called TeamPCP force-pushed malicious version tags
onto two popular security scanners — aquasecurity/trivy-action and
Checkmarx/kics-github-action — turning trusted, “immutable”-looking steps into
credential stealers inside thousands of pipelines
(CVE-2026-33634).
Tag force-pushed
A version tag like @v0.x is mutable, so the attacker rewrote the code behind a name teams
already trusted.
Runner executes it
uses: aquasecurity/trivy-action@v0.x runs that code with your pipeline's
credentials, on your runner.
Credentials stolen
The stealer scraped GitHub tokens, AWS IAM keys, GCP and Azure secrets from process memory, then exfiltrated them.
Scanning didn't save anyone. Static analysis and dependency scanning missed it because the malicious code lived inside a trusted, signed action — and the only real mitigation was to pin actions to full commit SHAs, because tags can be force-pushed and SHAs can't.
A webhook, not a workflow
audytx is a GitHub App backed by a hosted webhook — it never runs in your CI. GitHub sends a webhook when a pull request opens; audytx fetches and analyzes the Terraform on its own infrastructure and posts the comment back.
The attack surface TeamPCP exploited simply doesn't exist here. A webhook can't poison your pipeline.
For what audytx stores and how, see the trust page.
Exactly one class, gone
This immunity is specific — the GitHub-Action tag-poisoning class, not every supply-chain risk. No software is free of all of them, and we take our own dependencies and infrastructure seriously.
What's gone, specifically, is the exact thing TeamPCP weaponized: a trusted third-party step executing inside your CI with your credentials. That step never exists in the audytx path.
audytx's optional plan-upload enrichment does run inside your own GitHub Actions workflow, authenticated over short-lived OIDC instead of a shared secret. But it's your workflow and your code — not a pinned third-party action someone else can force-push out from under you.
Harden your pipeline anyway
Whether or not you use audytx, the TeamPCP playbook has three durable countermeasures. Do all three.
Pin to full SHAs
Pin every GitHub Action to a full commit SHA instead of a version tag — SHAs can't be force-pushed.
Rotate exposed creds
Rotate any credentials that could have been exposed during the TeamPCP windows.
Kill long-lived secrets
Skip tooling that needs long-lived secrets sitting in your runner; prefer short-lived OIDC.
The detailed incident write-ups from Arctic Wolf and Microsoft are worth reading in full.
Start free during the open beta
If you're re-evaluating your CI scanners after TeamPCP, the architecture matters as much as the check count — and there's nothing in your pipeline to poison.