Trivy Supply Chain Attack: TeamPCP Compromises Popular Security Scanner

The Aqua Security-developed Trivy vulnerability scanner was recently compromised in a sophisticated supply chain attack orchestrated by a threat actor known as TeamPCP. The attack resulted in the distribution of credential-stealing malware through official releases and GitHub Actions, impacting a widely used tool for identifying security vulnerabilities in software.

What is Trivy?

Trivy is a popular open-source security scanner used by developers and security teams to identify vulnerabilities, misconfigurations, and exposed secrets across various environments, including container images, Kubernetes clusters, code repositories, and cloud infrastructure. Its widespread adoption makes it a high-value target for attackers seeking to steal sensitive authentication credentials.

Timeline of the Attacks

This incident marks the second time Trivy has been targeted in a supply chain attack within a month. The initial compromise occurred between February 27 and March 2, 2026, when an autonomous bot called hackerbot-claw exploited a misconfiguration in Trivy’s GitHub Actions workflows to steal a Personal Access Token (PAT). This allowed the attacker to gain control of the repository and publish malicious versions of the Visual Studio Code extension to Open VSX.

The most recent attack, beginning on March 19, 2026, leveraged credentials that survived the incomplete rotation following the first incident, as well as a compromised aqua-bot service account. TeamPCP gained access and began making impersonated commits, pushing malicious code to both the actions/checkout repository (spoofing user rauchg) and the aquasecurity/trivy repository (spoofing user DmitriyLewen).

How the Attack Unfolded

At 17:43:37 UTC on March 19, 2026, the attackers pushed the malicious v0.69.4 tag to the Trivy repository, triggering an automated release pipeline. This resulted in the publication of backdoored binaries to GitHub Releases, Docker Hub, GHCR, and ECR. The attackers force-pushed modifications to 75 out of 76 version tags in the aquasecurity/trivy-action repository, redirecting them to malicious commits.

The compromised GitHub Actions – specifically, trivy-action and setup-trivy – executed malicious code before running legitimate Trivy scans, making the compromise challenging to detect. The infostealer collected reconnaissance data, including hostname, network configuration, and environment variables, and actively searched for credentials and authentication secrets in various files and locations.

What Data Was Targeted?

The infostealer targeted a wide range of sensitive data, including:

• SSH private and public keys
• Cloud and infrastructure credentials (Git, AWS, GCP, Azure, Kubernetes, Docker)
• Environment files (.env and related variants)
• Database credentials (PostgreSQL, MySQL/MariaDB, MongoDB, Redis)
• CI/CD configurations (Terraform, Jenkins, GitLab CI)
• TLS private keys
• VPN configurations
• Webhooks (Slack and Discord tokens)
• Shell history files
• System files (/etc/passwd, /etc/shadow)
• Cryptocurrency wallets

The malicious script likewise scanned memory regions used by the GitHub Actions Runner process for JSON strings indicating secrets.

Data Exfiltration and Persistence

Collected data was encrypted and archived into a file named tpcp.tar.gz, then exfiltrated to a typosquatted command-and-control server at scan.aquasecurtiy[.]org. If exfiltration failed, the malware created a public repository named tpcp-docs within the victim’s GitHub account and uploaded the stolen data there. To maintain persistence, the malware dropped a Python payload at ~/.config/systemd/user/sysmon.py and registered it as a systemd service, allowing for the download of additional payloads.

Attribution and Follow-Up Activity

The attack is attributed to the threat actor known as TeamPCP, also tracked as DeadCatx3, PCPcat, and ShellForce. This attribution is based on a comment within one of the infostealer payloads identifying it as “TeamPCP Cloud stealer.” TeamPCP is known for exploiting misconfigured Docker APIs, Kubernetes clusters, and other cloud-native technologies.

Researchers at Aikido have linked TeamPCP to a subsequent campaign involving a self-propagating worm named “CanisterWorm,” which targets npm packages. This worm installs a persistent backdoor and uses stolen npm tokens to publish malicious updates to other packages, utilizing Internet Computer (ICP) canisters for command and control.

Aqua Security’s Response

Aqua Security confirmed the incident, acknowledging that the attackers exploited credentials from the earlier, incompletely contained breach. The malicious Trivy release (v0.69.4) was live for approximately three hours, with compromised GitHub Actions tags remaining active for up to 12 hours. The attackers also attempted to delete Aqua Security’s initial disclosure of the earlier March incident.

Mitigation and Recommendations

Organizations that used affected versions of Trivy during the incident should treat their environments as fully compromised. Recommended actions include:

• Rotating all secrets, including cloud credentials, SSH keys, API tokens, and database passwords.
• Analyzing systems for additional signs of compromise.

This incident underscores the importance of robust supply chain security practices, including thorough secret rotation, continuous monitoring, and rapid incident response.