TeamPCP Supply Chain Campaign: Update 003 - Operational Tempo Shift as Campaign Enters Monetization Phase With No New Compromises in 48 Hours, (Sat, Mar 28th)

TeamPCP is a supply‑chain threat actor that has been compromising PyPI packages and security tooling to gain access and distribute malware. Between Feb 28 and Mar 28, 2026 the campaign escalated from the LiteLLM PyPI compromise to an additional Telnyx PyPI compromise, expanded impact (Checkmarx scope larger than initially reported), and a shift to active monetization via a Vect ransomware partnership and a mass affiliate program; CISA has added affected items to KEV and detection tools have been published. As of Update 003 (Mar 28) operators report no new compromises in the prior 48 hours but—