Trivy Supply Chain Attack Escalates as TeamPCP Hijacks 75 GitHub Action Tags, Defaced Aqua Security Repositories, and Spreads to npm
Threat actor TeamPCP compromised the widely used Trivy vulnerability scanner through a retained access token from an earlier incomplete remediation, injecting credential-stealing payloads into official releases and GitHub Actions while defacing 44 Aqua Security repositories.
Overview
A multi-stage supply chain attack against Aqua Security’s Trivy vulnerability scanner, one of the most widely deployed open-source security tools in DevSecOps, has escalated significantly since it first surfaced on March 19, 2026. The threat actor TeamPCP exploited credentials retained from an earlier, incompletely remediated breach to inject credential-stealing malware into official Trivy releases, hijack dozens of GitHub Action tags, deface 44 Aqua Security repositories, and spread laterally into the npm ecosystem, according to The Hacker News.
The incident has already affected more than 1,000 SaaS environments, with Mandiant estimating that downstream victims could eventually reach 10,000, according to CyberScoop.
Attack Timeline
The compromise traces back to late February 2026, when attackers exploited a misconfiguration in Trivy’s GitHub Actions environment and extracted a privileged access token tied to the “Argon-DevOps-Mgt” service account, which held write and admin access to both of Aqua Security’s GitHub organizations, according to The Hacker News.
Aqua Security disclosed the initial breach on March 1 and executed a credential rotation. However, the rotation was not comprehensive, allowing TeamPCP to retain residual access through still-valid credentials, as reported by The Hacker News.
On March 19 at approximately 17:43 UTC, the attacker used the compromised service account to force-push 75 of 76 version tags in the aquasecurity/trivy-action repository and all seven tags in aquasecurity/setup-trivy, redirecting trusted references to malicious commits. Simultaneously, release automation was triggered to publish a malicious Trivy binary designated v0.69.4, according to The Hacker News.
By March 22, the attackers escalated further, pushing malicious Docker images tagged as versions 0.69.5 and 0.69.6 to Docker Hub without corresponding GitHub releases. On the same day, all 44 repositories in Aqua Security’s “aquasec-com” GitHub organization were defaced within a two-minute window, renamed with a “tpcp-docs-” prefix and their descriptions set to “TeamPCP Owns Aqua Security,” as reported by The Hacker News.
Payload and Capabilities
The malicious versions of trivy-action and setup-trivy ran a tool self-described as the “TeamPCP Cloud stealer.” The payload performed memory scraping from the GitHub Actions Runner.Worker process, searching for patterns matching {"value":"<secret>","isSecret":true} to harvest CI/CD secrets. It also swept filesystems across more than 50 paths for AWS, GCP, and Azure credentials, SSH keys, Kubernetes tokens, and cryptocurrency wallets, according to The Hacker News.
Stolen data was encrypted using AES-256-CBC with RSA-4096 hybrid encryption and exfiltrated to a typosquatted command-and-control domain, scan.aquasecurtiy[.]org, hosted at 45.148.10.212 by TECHOFF SRV LIMITED in Amsterdam. As a fallback, the malware created a repository named “tpcp-docs” in the victim’s GitHub account and uploaded the encrypted bundle as a release asset, as reported by The Hacker News.
The attackers also deployed a self-propagating worm dubbed CanisterWorm through dozens of compromised npm packages, expanding the attack surface beyond Trivy’s direct user base, according to The Hacker News. A separate Kubernetes wiper component targeting Iranian systems was distributed using DaemonSets, as reported by The Hacker News.
Downstream Impact
Mandiant CTO Charles Carmakal warned that the fallout will extend well beyond Trivy’s immediate users. “There will likely be many other software packages, supply-chain attacks” resulting from this compromise, Carmakal said, according to CyberScoop.
The attackers are reportedly collaborating with multiple threat groups based primarily in the United States, Canada, and the United Kingdom, described by researchers as “very loud, very aggressive” in their extortion tactics, according to CyberScoop. Mandiant expects widespread breach disclosures, follow-on attacks, and downstream impacts to play out over the coming months, as reported by CyberScoop.
The vulnerability has been assigned CVE-2026-33634 with a CVSS score of 9.4, according to The Hacker News.
Remediation
Organizations using Trivy are advised to audit all instances for versions 0.69.4 through 0.69.6 across GitHub Releases, Docker Hub, Amazon ECR, and GitHub Container Registry. The last confirmed clean release is version 0.69.3. Workflows referencing aquasecurity/trivy-action or aquasecurity/setup-trivy should be reviewed, with particular attention to run logs from March 19 onward, according to The Hacker News.
GitHub organizations should be searched for unauthorized repositories named “tpcp-docs,” which indicate successful credential exfiltration. All secrets accessible to compromised workflows should be rotated immediately. Security teams should pin GitHub Actions to full SHA commit hashes rather than version tags to prevent future tag manipulation attacks, as recommended by The Hacker News.
The incident underscores the risks of long-lived service account tokens with broad organizational access, a pattern common in CI/CD environments that effectively converts a single compromised credential into an organization-wide supply chain vector.