Trivy Supply Chain Compromise — TeamPCP Credential-Stealing Malware Injected into CI/CD Pipelines (CVE-2026-33634)
Trivy Supply Chain Compromise (TL-2026-0280), also tracked as Trivy Supply Chain Attack, is a critical-severity supply-chain compromise scored CVSS 9.4, first published 2026-03-24. It is attributed to TeamPCP with high confidence, affects Aqua Security trivy-action (GitHub Action), references 1 CVE (CVE-2026-33634), maps to 28 MITRE ATT&CK techniques (T1005, T1021, T1027), and is covered by 9 detection rules and 27 indicators of compromise.
Key facts for TL-2026-0280
- Threat ID
- TL-2026-0280
- Also known as
- Trivy Supply Chain Attack, TeamPCP Trivy Compromise, CanisterWorm Campaign
- Severity
- CRITICAL
- CVSS
- 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L)
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- 2026-03-24
- Last reviewed
- 2026-03-24
- Attribution
- TeamPCP
- Attribution confidence
- HIGH
- Motivation
- DESTRUCTION
- Target sectors
- technology, financial, government, healthcare, cloud-infrastructure, software-development, devops
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Trivy Supply Chain Compromise
Malware and tooling: CanisterWorm, TeamPCP Cloud Stealer, ICP Canister tdtqy-oyaaa-aaaae-af2dq-cai
Threat actor TeamPCP compromised Aqua Security's Trivy vulnerability scanner distribution channels — GitHub Actions (trivy-action, setup-trivy), Docker Hub images, and npm packages — to inject credential-stealing malware into CI/CD pipelines worldwide. The attack force-pushed 75 of 76 version tags to malicious commits, exfiltrating secrets via typosquatted domains and ICP blockchain C2, then expanded via CanisterWorm to npm and Kubernetes environments.
How Trivy Supply Chain Compromise works
On March 19, 2026, threat actor TeamPCP weaponized compromised credentials from Aqua Security's CI/CD infrastructure to execute a multi-stage supply chain attack against the Trivy vulnerability scanner ecosystem, one of the most widely-used open-source container security tools.
The attack began in late February 2026 when TeamPCP exploited a misconfigured pull_request_target workflow in the Trivy GitHub repository. An automated bot dubbed 'hackerbot-claw' extracted a privileged Personal Access Token (PAT) belonging to the Argon-DevOps-Mgt service account (GitHub ID 139343333). Despite an initial disclosure on March 1 and partial credential rotation, the rotation was incomplete, leaving residual access paths that TeamPCP exploited on March 19.
The primary attack vector involved force-pushing 75 of 76 version tags in aquasecurity/trivy-action and all 7 tags in aquasecurity/setup-trivy to point to malicious commits. Since most GitHub Actions workflows reference actions by mutable version tags rather than immutable commit SHAs, thousands of CI/CD pipelines automatically pulled the poisoned code. Only trivy-action v0.35.0 remained uncompromised due to GitHub's immutable releases protection.
The malicious entrypoint.sh (204 lines, 17,592 bytes vs. legitimate 2,855 bytes) operated in three stages. Stage 1 discovered GitHub Actions runner processes (Runner.Worker, Runner.Listener, runsvc) and read their /proc/{PID}/environ files. On hosted runners, it escalated via passwordless sudo to dump Runner.Worker process memory using /proc/{PID}/mem, searching for JSON patterns matching '{"value":"<secret>","isSecret":true}'. On self-hosted runners, a Python script ('TeamPCP Cloud stealer') harvested SSH keys, AWS/GCP/Azure credentials, Kubernetes configs, Docker registry auth, database credentials, Terraform state, TLS certificates, .env files, and cryptocurrency wallet keys across 50+ file paths.
Stage 2 encrypted collected data using AES-256-CBC with a PBKDF2-derived key from a 32-byte random session, wrapping the session key with a hardcoded RSA-4096 public key (OAEP padding), bundling everything into tpcp.tar.gz. Stage 3 exfiltrated via HTTPS POST to the typosquatted domain scan.aquasecurtiy[.]org with a custom X-Filename header. A fallback mechanism created a public tpcp-docs repository on the victim's GitHub account and uploaded the encrypted bundle as a release asset.
The attack expanded rapidly. On March 22, malicious Docker Hub images (trivy 0.69.4, 0.69.5, 0.69.6) were published without corresponding GitHub releases. Simultaneously, TeamPCP deployed CanisterWorm — a self-propagating worm that leveraged stolen npm publish tokens to compromise 47+ npm packages (later expanding to 141 malicious artifacts across 66+ packages). CanisterWorm used ICP blockchain canisters as dead drop resolvers for C2, installed systemd persistence masquerading as PostgreSQL tooling (pgmon), and spread via SSH using stolen keys and exposed Docker APIs on port 2375.
TeamPCP also defaced all 44 repositories in Aqua Security's aquasec-com GitHub organization within a 2-minute automated blitz, renaming them with tpcp-docs- prefixes. A destructive Kubernetes wiper payload deployed privileged DaemonSets targeting Iranian systems specifically — wiping and force-rebooting via a 'kamikaze' container — while installing CanisterWorm backdoors on non-Iranian nodes. The campaign expanded to PyPI on March 24 with poisoned litellm packages (versions 1.82.7, 1.82.8).
MITRE ATT&CK techniques used in TL-2026-0280
collection
T1005 Data from Local System; T1056 Input Capture; T1119 Automated Collection
lateral-movement
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal
exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
discovery
T1057 Process Discovery; T1082 System Information Discovery; T1087 Account Discovery
execution
T1059 Command and Scripting Interpreter; T1648 Serverless Execution
command-and-control
T1102 Web Service; T1573 Encrypted Channel
initial-access
T1195 Supply Chain Compromise; T1199 Trusted Relationship
impact
T1485 Data Destruction; T1491 Defacement
credential-access
T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
persistence
T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
resource-development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1588 Obtain Capabilities
Affected products and versions in Trivy Supply Chain Compromise
- Aqua Security — trivy-action (GitHub Action)
Vulnerable versions: 0.0.1 through 0.34.2 (75 of 76 tags)
Fixed in: 0.35.0; SHA 57a97c7e7821a5776cebc9bb87c984fa69cba8f1 - Aqua Security — setup-trivy (GitHub Action)
Vulnerable versions: All 7 tags - Aqua Security — Trivy (Docker Hub image)
Vulnerable versions: 0.69.4; 0.69.5; 0.69.6
Fixed in: 0.69.3 and earlier - Aqua Security — Trivy (CLI binary)
Vulnerable versions: 0.69.4
Fixed in: 0.69.3 and earlier - Multiple — npm packages (@EmilGroup, @opengov, @teale.io, @airtm, @pypestream scopes)
Vulnerable versions: 47+ packages compromised via CanisterWorm - BerriAI — litellm (PyPI)
Vulnerable versions: 1.82.7; 1.82.8
Fixed in: 1.82.6 and earlier
Remediation for Trivy Supply Chain Compromise
Patches
- Update to Trivy v0.69.3 or latest verified clean release
- Use trivy-action v0.35.0 (only uncompromised tag) or pin to SHA 57a97c7e7821a5776cebc9bb87c984fa69cba8f1
Immediate actions
- Pin all GitHub Actions to immutable full commit SHAs — never mutable version tags
- Pin trivy-action to safe commit SHA 57a97c7e7821a5776cebc9bb87c984fa69cba8f1 or use only v0.35.0
- Remove all Trivy Docker images versions 0.69.4, 0.69.5, and 0.69.6 — use 0.69.3 or earlier
- Search GitHub organizations for tpcp-docs repositories indicating successful exfiltration
- Block IOC domains and IPs at perimeter: scan.aquasecurtiy.org, 45.148.10.212, models.litellm.cloud
- Audit GitHub Actions logs for trivy-action runs after 19:00 UTC March 19, 2026
- Check for unauthorized systemd services masquerading as pgmon or sysmon
Workarounds
- Run Trivy as a standalone binary downloaded from verified GitHub releases with GPG signature verification
- Use alternative container scanning tools until full remediation is confirmed
- Disable pull_request_target triggers in public repositories
- Restrict GitHub Actions to approved actions via organization settings
Longer-term hardening
- Implement GitHub Actions allow-listing with commit SHA pinning as organizational policy
- Deploy secret scanning on all CI/CD pipelines to detect credential exposure in real-time
- Rotate ALL secrets accessible to compromised workflows: cloud credentials, SSH keys, API tokens, database passwords, Docker registry credentials, npm tokens
- Implement runtime integrity monitoring for CI/CD runner environments
- Enforce least-privilege for GitHub service accounts with short-lived tokens
- Monitor for ICP blockchain-based C2 channels in network traffic
- Deploy EDR with behavioral detection on CI/CD runners and build infrastructure
CVEs associated with Trivy Supply Chain Compromise
Weaknesses (CWE) in Trivy Supply Chain Compromise
CWE-506, CWE-494, CWE-829, CWE-798
Timeline of Trivy Supply Chain Compromise
- TeamPCP exploited misconfigured pull_request_target workflow in Trivy repository; hackerbot-claw bot extracted privileged PAT from Argon-DevOps-Mgt service account (GitHub ID 139343333)
- Initial public disclosure of Trivy CI compromise; Aqua Security began credential rotation but rotation was incomplete, leaving residual access paths
- Socket detected suspicious activity at ~19:15 UTC, generating 182 threat feed entries classified as Backdoor, Infostealer, and Reconnaissance
- TeamPCP force-pushed 75 of 76 trivy-action tags and all 7 setup-trivy tags to malicious commits at 17:43:37 UTC; malicious Trivy v0.69.4 binary published
- CrowdStrike, Wiz, SecurityWeek, and The Hacker News publish technical analyses; Aqua Security confirms compromise and begins remediation
- ICP canister tdtqy-oyaaa-aaaae-af2dq-cai marked 'Unavailable Due to Policy Violation' at 21:31 UTC
- All 44 repositories in aquasec-com GitHub organization defaced in automated 2-minute blitz between 20:31:07-20:32:26 UTC; renamed with tpcp-docs- prefix
- Malicious Trivy Docker Hub images v0.69.5 and v0.69.6 published at 16:00 UTC without corresponding GitHub releases
- CanisterWorm deployed to npm ecosystem at 13:15 UTC, compromising 47+ packages across @EmilGroup, @opengov, @teale.io, @airtm, @pypestream scopes using stolen publish tokens
- CVE-2026-33634 assigned with CVSS score 9.4; Kubernetes wiper payload discovered targeting Iranian systems with destructive DaemonSets
- Campaign expanded to PyPI with poisoned litellm packages (v1.82.7, v1.82.8); new exfiltration endpoint models.litellm.cloud identified; Microsoft publishes detection guidance
- As of 2026-05-29, the Trivy compromise itself is remediated — Aqua removed malicious artifacts within ~4h on Mar 19, restored 75 force-pushed tags, and the typosquat/ICP C2 is down — but TeamPCP (UNC6780) stays undisrupted with no arrests. The actor escalated through May 2026 (Checkmarx, ~170 npm/PyPI packages, GitHub infra breach), and stolen CI/CD secrets still require rotation.
Sources cited for Trivy Supply Chain Compromise
- Microsoft Security Blog: Detecting, investigating, and defending against the Trivy supply chain compromise
- CrowdStrike: From Scanner to Stealer — Inside the trivy-action Supply Chain Compromise
- Wiz: Trivy Compromised by TeamPCP — Supply Chain Attack Analysis
- Aqua Security: Trivy Supply Chain Attack — What You Need to Know (Updated)
- Socket: Trivy Under Attack Again — Widespread GitHub Actions Tag Compromise
- GitGuardian: Trivy March Supply Chain Attack Shows Where Secret Exposure Hurts Most
- The Hacker News: Trivy Hack Spreads Infostealer via Docker, Triggers Worm and Kubernetes Wiper
- The Hacker News: Trivy Supply Chain Attack Triggers Self-Spreading CanisterWorm Across 47 npm Packages
- SecurityWeek: Aqua's Trivy Vulnerability Scanner Hit by Supply Chain Attack
- Security Affairs: 44 Aqua Security Repositories Defaced After Trivy Supply Chain Breach
- The Hacker News: Trivy Security Scanner GitHub Actions Breached, 75 Tags Hijacked
- Sysdig: TeamPCP Expands — Supply Chain Compromise Spreads from Trivy to Checkmarx
- Infosecurity Magazine: Trivy Supply Chain Attack Expands With Compromised Docker Images
- CyberPress: Trivy Supply Chain Attack Spreads Through Compromised Docker Hub Images
Threats related to Trivy Supply Chain Compromise
- TeamPCP Supply Chain Campaign: LiteLLM PyPI Compromise, CanisterWorm npm Propagation, and Multi-Ecosystem Attack (CVE-2026-33634)
- TeamPCP LiteLLM Supply Chain Attack — Trojaned PyPI Packages (v1.82.7/1.82.8) with Multi-Stage C2 Payload
- Trivy Supply Chain Attack — Credential Theft Infostealer via Malicious GitHub Actions Tags (GHSA-69fq-xp46-6x23)
- TeamPCP Partners With Vect Ransomware Group to Escalate Cross-Ecosystem Open Source Supply Chain Attacks
- Checkmarx KICS GitHub Action Supply Chain Compromise by TeamPCP (kics-github-action Tag Hijacking)
- TeamPCP Supply Chain Attack on LiteLLM — Trojanized PyPI Packages with .pth Persistence and Multi-Stage Credential Stealer
Detection coverage for TL-2026-0280
As of 2026-03-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0280 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.