They hid Malware in Audio?

A detailed breakdown of the Team PCP supply chain attack campaign, covering multiple compromised security tools including Trivy and Checkmarx, a malicious npm worm, and trojanized VS Code extensions on Open VSX. The most technically interesting aspect involves steganography: malware hidden inside valid WAV audio files and PNG images, decoded via XOR to drop payloads. The analysis also covers a Python .pth file persistence trick, ETW patching to evade EDR telemetry, and C2 communication disguised with lookalike domains. Mitigation advice focuses on least-privilege GitHub Actions tokens, zero-trust principles, and regular credential rotation.