CVE-2026-33634-Scanner

Automated scanner for detecting indicators of compromise (IOCs) associated with the TeamPCP supply chain attack (CVE-2026-33634)

---

📋 Table of Contents

• Overview
• Vulnerability
• Features
• Detected IOCs
• Installation
• Usage
• Examples
• Report Format
• Project Structure
• System Requirements
• Contributions
• License
• Author
• References

---

🎯 Overview

CVE-2026-33634-Scanner is a security tool designed to detect indicators of compromise (IOCs) related to the TeamPCP supply chain attack, a critical vulnerability affecting multiple software components distributed through compromised channels.

The tool performs a thorough sweep for:

• Malicious files using SHA256 hashes
• Network connections to command and control (C2) infrastructure
• DNS queries to suspicious domains
• Access to previously identified malicious URLs

---

⚠️ Vulnerability

Technical Description

The CVE-2026-33634 vulnerability allows an attacker to inject malicious code into legitimate software components during the build or distribution process. Once downloaded and installed, the compromised artifacts establish communication with attacker-controlled C2 servers, enabling:

• Remote command execution
• Exfiltration of sensitive information
• Persistence on compromised systems
• Lateral movement within the corporate network

---

🚀 Features

---

🛡️ Detected IOCs

SHA256 Hashes (7 indicators)

Report Format JSON json { "scan_time": "2026-03-30T10:30:00", "ioc_summary": { "attack_name": "TeamPCP Supply Chain Attack", "cve": "CVE-2026-33634", "cvss_score": 9.4, "sha256_count": 7, "ip_count": 2, "domain_count": 4, "url_count": 4 }, "detections": [...], "summary": {...} } CSV CSV file with columns: timestamp, type, detail, source, etc.

🛡️ Detected IOCs Type Indicators SHA256 7 malicious hashes IPs 83.142.209.11, 45.148.10.212 Domains checkmarx.zone, aquasecurtiy.org, litellm.cloud, tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io URLs checkmarx.zone