# CHQ-ED-2026-015

- **Artifact ID:** CHQ-ED-2026-015
- **Public record:** https://record.cybersecurityhq.com/evidence/chq-ed-2026-015
- **Machine-record SHA-256:** `58314bf4f28d060671699c256979ba0bfbf07891d44b03103c25e96e01d546ed`

## Complete structured record

```json
{
  "id": "CHQ-ED-2026-015",
  "associated_position": "CHQ-P-2026-015 v1.0",
  "relationship": "original",
  "issuance_date": "2026-03-25",
  "evidence_freeze_time": "2026-03-25T00:00:00Z",
  "total_exhibits": 4,
  "docket_status": "LOCKED",
  "docket_version": "1.0",
  "artifact_class": "EVIDENCE_DOCKET",
  "authority_level": "SUPPORTING_RECORD",
  "reliance_status": "CONTEXT_ONLY",
  "temporal_scope": "CONTEMPORANEOUS",
  "update_policy": "APPEND_ONLY",
  "exhibits": [],
  "claims": [
    {
      "claim_id": "C-01",
      "position_section": "Evidence Basis — Primary Signal",
      "claim_text": "TeamPCP compromised Aqua Security's Trivy vulnerability scanner and associated GitHub Actions (trivy-action, setup-trivy). 75 of 76 version tags force-pushed to malicious payloads. Credential stealer exfiltrated SSH keys, cloud credentials, Kubernetes tokens, Docker registry credentials, npm tokens, and TLS private keys from every pipeline that ran the compromised action.",
      "evidence_exhibits": [],
      "relevant_sections": "",
      "verification_type": "",
      "source_text": "SN-2026-03-19-01: Trivy GitHub Actions Compromise — GitHub Actions runners granted the compromised action full access to pipeline secrets as a design feature. No verification occurred between the tag reference and the code that executed. The action inherited the runner's authority by virtue of being referenced, not by virtue of being verified. Source: Wiz / StepSecurity / Socket / Aikido Security / Amazon MadPot. Independence: INDEPENDENT (multiple analytical teams, distinct telemetry).",
      "evidence_class": "E1"
    },
    {
      "claim_id": "C-02",
      "position_section": "Evidence Basis — Primary Signal",
      "claim_text": "Stolen npm tokens from the Trivy pipeline compromise were used to publish malicious packages across 47+ npm packages. CanisterWorm deployed as a self-propagating credential harvester using ICP blockchain canister as C2 dead drop.",
      "evidence_exhibits": [],
      "relevant_sections": "",
      "verification_type": "",
      "source_text": "SN-2026-03-20-01: GlassWorm Wave 3 / CanisterWorm — npm's postinstall hook mechanism grants executing code full access to the developer's environment as a design feature. The registry accepted publication because the token was valid. The token was valid because it was stolen from a pipeline that granted it without verification. At no point did any system verify that the publishing entity was the legitimate maintainer. Source: Aikido Security / Socket / Endor Labs / JFrog / Mend.io. Independence: INDEPENDENT.",
      "evidence_class": "E1"
    },
    {
      "claim_id": "C-03",
      "position_section": "Evidence Basis — Primary Signal",
      "claim_text": "On March 23, 35 tags in the Checkmarx KICS GitHub Action were hijacked between 12:58–16:50 UTC. Identical credential stealer payload as the Trivy operation. Checkmarx AST Open VSX extensions (ast-results v2.53.0, cx-dev-assist v1.7.0) also compromised.",
      "evidence_exhibits": [],
      "relevant_sections": "",
      "verification_type": "",
      "source_text": "SN-2026-03-23-01: Checkmarx KICS GitHub Action Compromise — The stolen credentials from the Trivy compromise were sufficient to poison additional GitHub Actions in unrelated repositories. No new vulnerability was required. The existing trust model was sufficient for propagation. Source: Wiz / Sysdig / ReversingLabs. Independence: INDEPENDENT (Sysdig detected via runtime telemetry independent of Wiz advisory analysis).",
      "evidence_class": "E1"
    },
    {
      "claim_id": "C-04",
      "position_section": "Evidence Basis — Primary Signal",
      "claim_text": "On March 24, malicious LiteLLM versions 1.82.7 and 1.82.8 published to PyPI. LiteLLM is present in 36% of cloud environments with approximately 480 million PyPI downloads, centralizing API credentials for over 100 LLM providers. LiteLLM's CI/CD pipeline ran Trivy as part of its build process; the compromised action exfiltrated the PYPI_PUBLISH token.",
      "evidence_exhibits": [],
      "relevant_sections": "",
      "verification_type": "",
      "source_text": "SN-2026-03-24-02: LiteLLM PyPI Package Compromise — LiteLLM's build pipeline executed Trivy. The pipeline could not distinguish between legitimate Trivy and compromised Trivy. The compromised code inherited the pipeline's full credential set, including the PyPI publish token. The publish token granted authority to distribute packages to every LiteLLM consumer. The entire chain operated through inherited authority with zero verification at any boundary. Source: Wiz / Endor Labs / JFrog / Snyk / ReversingLabs / Microsoft Security Blog. Independence: INDEPENDENT (seven analytical teams).",
      "evidence_class": "E1"
    },
    {
      "claim_id": "C-05",
      "position_section": "Evidence Basis — Primary Signal",
      "claim_text": "The aggregate cascade from the initial Trivy compromise through CanisterWorm, Checkmarx KICS, Checkmarx AST, and LiteLLM. Five ecosystems affected: GitHub Actions, Docker Hub, npm, Open VSX, PyPI. Campaign operated continuously from March 19–25 with escalating scope at each stage.",
      "evidence_exhibits": [],
      "relevant_sections": "",
      "verification_type": "",
      "source_text": "SN-2026-03-25-01: Trivy-to-Ecosystem Credential Cascade — Each stage of the cascade was enabled by execution authority inherited in the previous stage. No stage required a new exploit or vulnerability. Each stage required only that the next system in the chain treat distribution as authorization. The credential stolen in stage N was sufficient to compromise stage N+1 because stage N+1 granted execution authority based on provenance alone. Source: Aggregate across all sources above. Independence: INDEPENDENT (campaign documented by 10+ independent analytical teams).",
      "evidence_class": "E1"
    },
    {
      "claim_id": "C-06",
      "position_section": "Evidence Basis — Reinforcing Signal",
      "claim_text": "Langflow CVE-2026-33017 exploited within hours of advisory publication. Attackers targeted accumulated execution authority: API keys for LLM providers, cloud credentials, database connections held by the platform as a byproduct of its integration function.",
      "evidence_exhibits": [],
      "relevant_sections": "",
      "verification_type": "",
      "source_text": "SN-2026-03-17-02: Langflow CVE-2026-33017 — Langflow's design aggregates credentials from multiple external services into a single execution context. Compromising the platform granted access to every service it connected to. This is the same structural condition as LiteLLM but at the application layer rather than the build layer. Both demonstrate that execution authority aggregation creates high-leverage targets regardless of the system's intended function. Source: CISA KEV / Horizon3.ai / The Hacker News. Independence: INDEPENDENT.",
      "evidence_class": "E2"
    },
    {
      "claim_id": "C-07",
      "position_section": "Evidence Pattern — Authority Inheritance Without Verification",
      "claim_text": "In every primary signal, execution authority was inherited from an upstream source without any verification at the point of execution. GitHub Actions runners inherited authority from tag references. npm consumers inherited authority from postinstall hooks. PyPI consumers inherited authority from package installation. In no case did the executing system verify that the code had the right to exercise the authority it inherited.",
      "evidence_exhibits": [],
      "relevant_sections": "",
      "verification_type": "",
      "source_text": "Pattern across SN-2026-03-19-01, SN-2026-03-20-01, SN-2026-03-23-01, SN-2026-03-24-02, SN-2026-03-25-01. The authorization decision was assumed from the act of distribution. Provenance was intact throughout the chain. Authority was not.",
      "evidence_class": "E1"
    }
  ],
  "signals": [
    {
      "signal_id": "SN-2026-03-19-01",
      "signal_type": "INCIDENT_REPORT",
      "classification": "PRIMARY",
      "evidence_exhibits": [
        "CHQ-EX-2026-009",
        "CHQ-EX-2026-010"
      ],
      "evidence_note": "Trivy GitHub Actions compromise — 75 of 76 version tags force-pushed to malicious payloads. Runners granted compromised action full credential access as a design feature. No verification at tag reference → code execution boundary. CCD_INTEGRITY: STRONG."
    },
    {
      "signal_id": "SN-2026-03-20-01",
      "signal_type": "INCIDENT_REPORT",
      "classification": "PRIMARY",
      "evidence_exhibits": [
        "CHQ-EX-2026-009",
        "CHQ-EX-2026-012"
      ],
      "evidence_note": "GlassWorm Wave 3 / CanisterWorm — npm ecosystem propagation via stolen tokens. 47+ packages. Self-propagating credential harvester using ICP blockchain C2. Registry accepted publication because token was valid — no independent verification of publisher identity."
    },
    {
      "signal_id": "SN-2026-03-23-01",
      "signal_type": "INCIDENT_REPORT",
      "classification": "PRIMARY",
      "evidence_exhibits": [],
      "evidence_note": "Checkmarx KICS GitHub Action — 35 tags hijacked in 3h52m. Identical payload to Trivy operation. Trivy credentials sufficient for cross-repository poisoning without new exploit. CCD_INTEGRITY: STRONG (confidence patched PROVISIONAL → CONFIRMED on independent verification by 7 teams)."
    },
    {
      "signal_id": "SN-2026-03-24-02",
      "signal_type": "INCIDENT_REPORT",
      "classification": "PRIMARY",
      "evidence_exhibits": [],
      "evidence_note": "LiteLLM PyPI compromise — pipeline ran Trivy without version pinning; PYPI_PUBLISH token exfiltrated; malicious packages published to registry with 480M downloads. CI/CD-to-runtime boundary did not function as a control surface. Seven analytical teams independently confirmed."
    },
    {
      "signal_id": "SN-2026-03-25-01",
      "signal_type": "INCIDENT_REPORT",
      "classification": "PRIMARY",
      "evidence_exhibits": [],
      "evidence_note": "Trivy cascade aggregate — five ecosystems (GitHub Actions, Docker Hub, npm, Open VSX, PyPI) crossed in six days with no authorization decision at any boundary. Each boundary accepted incoming credential as authorized based on provenance within previous ecosystem. CCD_INTEGRITY: STRONG. ALIGNMENT_PRESSURE: HIGH."
    },
    {
      "signal_id": "SN-2026-03-17-02",
      "signal_type": "INCIDENT_REPORT",
      "classification": "REINFORCING",
      "evidence_exhibits": [
        "CHQ-EX-2026-013"
      ],
      "evidence_note": "Langflow CVE-2026-33017 — AI platform exploiting execution authority aggregation through application vulnerability. Independent failure mode (direct exploitation vs. supply chain propagation), same structural condition. Separate actor, separate vector."
    }
  ],
  "linked_exhibits": [
    {
      "id": "CHQ-EX-2026-009",
      "title": "GlassWorm Wave 1–3: Multi-Registry Supply Chain Campaign",
      "temporal_tag": "CONTEMPORANEOUS (2026-03)"
    },
    {
      "id": "CHQ-EX-2026-010",
      "title": "Rust Crates CI/CD Supply Chain Attack: hackerbot-claw & Trivy Extension Compromise",
      "temporal_tag": "CONTEMPORANEOUS (2026-03)"
    },
    {
      "id": "CHQ-EX-2026-012",
      "title": "ZOMBI RAT: Solana Blockchain C2 and Self-Propagating Credential Theft",
      "temporal_tag": "CONTEMPORANEOUS (2026-03)"
    },
    {
      "id": "CHQ-EX-2026-013",
      "title": "Interlock Ransomware: Cisco FMC Zero-Day Exploitation Campaign",
      "temporal_tag": "CONTEMPORANEOUS (2026-03)"
    }
  ],
  "cross_references": [
    {
      "id": "CHQ-P-2026-014",
      "title": "Management Plane Compromise Produces Deterministic Control That Operates Outside Identity Enforcement",
      "relationship": "P-014 and P-015 describe two control surfaces the traditional security model does not govern. P-014: management infrastructure. P-015: execution pipelines. Both exercise authority without verification. These positions constrain each other and together define the unverified control surface topology of the modern enterprise."
    },
    {
      "id": "CHQ-P-2026-013",
      "title": "Portable Developer Identity Creates Portable Compromise",
      "relationship": "Developer identity portability is the propagation mechanism that execution authority inheritance exploits. P-013 establishes that portable identity means portable compromise. P-015 establishes the structural reason: portable identity carries portable execution authority, and no system verifies that authority at the point of use."
    },
    {
      "id": "CHQ-P-2026-011",
      "title": "Deployed Security Tool Presence Cannot Serve as Evidence of Functioning Control",
      "relationship": "Trivy was deployed as a security scanner. Its presence in CI/CD pipelines was evidence of security practice. Its compromise converted that presence into an attack vector. P-011's claim is directly instantiated by the TeamPCP campaign."
    },
    {
      "id": "CHQ-P-2026-002",
      "title": "Verification Collapse Is a Structural Condition of the Current Security Environment",
      "relationship": "P-015 identifies a specific domain where verification collapse is structural: execution pipelines. The verification primitive that would prevent inherited authority exploitation does not exist at scale."
    }
  ],
  "notice": [
    "This docket compiles evidence supporting CHQ-P-2026-015 v1.0 (Execution Pipelines Function as Control Planes Without Verification Primitives Capable of Validating the Authority They Execute).",
    "Primary signals represent a single campaign (TeamPCP, March 19–25, 2026) operating across five ecosystems. Per CHQ convergence constraint, this is one operational campaign, not independent observations. However, the position's structural claim does not depend on the campaign being repeated by independent actors. The claim is that execution pipelines function as control planes without verification primitives. The TeamPCP campaign is evidence that this structural condition exists and is exploitable.",
    "Supporting independence: The Langflow signal (reinforcing) is a separate campaign by a separate actor exploiting the same structural condition (execution authority aggregation) through a different mechanism. This provides one independent observation of the same structural property through a different attack vector.",
    "Two failure modes present: (1) supply chain propagation via inherited execution authority (TeamPCP chain), and (2) direct exploitation of execution authority aggregation surfaces (Langflow). Both instantiate the same structural condition through different mechanisms.",
    "No signals in this docket carry CCD_INTEGRITY = DEGRADED. No signals carry CONFIDENCE = CLAIM_ONLY. Docket issued under CHQ-D-2026-ESG v1.0. Pattern register entry: CHQ-PB-015."
  ],
  "integrity_statement": [
    "This docket records claim-to-source mappings for CHQ-P-2026-015 v1.0.",
    "Primary signals: SN-2026-03-23-01 confidence patched from PROVISIONAL to CONFIRMED based on independent verification by seven additional analytical teams (Microsoft, Wiz, Snyk, Sysdig, Endor Labs, JFrog, ReversingLabs). The cascade mechanism initially classified PROVISIONAL is now CONFIRMED.",
    "SN-2026-03-25-01 (aggregate cascade): CCD record — six layers decomposed, four load-bearing (all CONFIRMED), two supporting (UNVERIFIED — excluded from signal statement). CCD_INTEGRITY: STRONG. ALIGNMENT_PRESSURE: HIGH.",
    "Primary signals compiled from CHQ Classification Log. All signals passed TSEM evaluation. Source independence assessed per CCD enforcement protocol. Failure mode independence assessed per convergence scaling constraint.",
    "Docket issued under CHQ-D-2026-ESG v1.0. Reliance recognized only when registered under CHQ-R-2026-001."
  ],
  "docket_hash": "",
  "immutability_layers": [
    {
      "layer": "Layer 1",
      "protects": "CHQ-ED-2026-015 Docket Hash",
      "scope": "the evidence record (claim-to-source mapping)"
    },
    {
      "layer": "Layer 2",
      "protects": "CHQ-P-2026-015 v1.0 Position Hash",
      "scope": "the position text"
    }
  ]
}
```