# Trivy Supply Chain Compromise — TeamPCP Credential-Stealing Malware Injected into CI/CD Pipelines (CVE-2026-33634)

> Threat actor TeamPCP compromised Aqua Security's Trivy vulnerability scanner distribution channels — GitHub Actions (trivy-action, setup-trivy), Docker Hub images, and npm packages — to inject credential-stealing malware into CI/CD pipelines worldwide. The attack force-pushed 75 of 76 version tags to malicious commits, exfiltrating secrets via typosquatted domains and ICP blockchain C2, then expanded via CanisterWorm to npm and Kubernetes environments.

- **Published:** 2026-03-24T12:00:00Z
- **Last reviewed:** 2026-03-24T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0280
- **ID:** TL-2026-0280
- **Severity:** CRITICAL (CVSS 9.4)
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33634

## Description

On March 19, 2026, threat actor TeamPCP weaponized compromised credentials from Aqua Security's CI/CD infrastructure to execute a multi-stage supply chain attack against the Trivy vulnerability scanner ecosystem, one of the most widely-used open-source container security tools.

The attack began in late February 2026 when TeamPCP exploited a misconfigured pull_request_target workflow in the Trivy GitHub repository. An automated bot dubbed 'hackerbot-claw' extracted a privileged Personal Access Token (PAT) belonging to the Argon-DevOps-Mgt service account (GitHub ID 139343333). Despite an initial disclosure on March 1 and partial credential rotation, the rotation was incomplete, leaving residual access paths that TeamPCP exploited on March 19.

The primary attack vector involved force-pushing 75 of 76 version tags in aquasecurity/trivy-action and all 7 tags in aquasecurity/setup-trivy to point to malicious commits. Since most GitHub Actions workflows reference actions by mutable version tags rather than immutable commit SHAs, thousands of CI/CD pipelines automatically pulled the poisoned code. Only trivy-action v0.35.0 remained uncompromised due to GitHub's immutable releases protection.

The malicious entrypoint.sh (204 lines, 17,592 bytes vs. legitimate 2,855 bytes) operated in three stages. Stage 1 discovered GitHub Actions runner processes (Runner.Worker, Runner.Listener, runsvc) and read their /proc/{PID}/environ files. On hosted runners, it escalated via passwordless sudo to dump Runner.Worker process memory using /proc/{PID}/mem, searching for JSON patterns matching '{"value":"<secret>","isSecret":true}'. On self-hosted runners, a Python script ('TeamPCP Cloud stealer') harvested SSH keys, AWS/GCP/Azure credentials, Kubernetes configs, Docker registry auth, database credentials, Terraform state, TLS certificates, .env files, and cryptocurrency wallet keys across 50+ file paths.

Stage 2 encrypted collected data using AES-256-CBC with a PBKDF2-derived key from a 32-byte random session, wrapping the session key with a hardcoded RSA-4096 public key (OAEP padding), bundling everything into tpcp.tar.gz. Stage 3 exfiltrated via HTTPS POST to the typosquatted domain scan.aquasecurtiy[.]org with a custom X-Filename header. A fallback mechanism created a public tpcp-docs repository on the victim's GitHub account and uploaded the encrypted bundle as a release asset.

The attack expanded rapidly. On March 22, malicious Docker Hub images (trivy 0.69.4, 0.69.5, 0.69.6) were published without corresponding GitHub releases. Simultaneously, TeamPCP deployed CanisterWorm — a self-propagating worm that leveraged stolen npm publish tokens to compromise 47+ npm packages (later expanding to 141 malicious artifacts across 66+ packages). CanisterWorm used ICP blockchain canisters as dead drop resolvers for C2, installed systemd persistence masquerading as PostgreSQL tooling (pgmon), and spread via SSH using stolen keys and exposed Docker APIs on port 2375.

TeamPCP also defaced all 44 repositories in Aqua Security's aquasec-com GitHub organization within a 2-minute automated blitz, renaming them with tpcp-docs- prefixes. A destructive Kubernetes wiper payload deployed privileged DaemonSets targeting Iranian systems specifically — wiping and force-rebooting via a 'kamikaze' container — while installing CanisterWorm backdoors on non-Iranian nodes. The campaign expanded to PyPI on March 24 with poisoned litellm packages (versions 1.82.7, 1.82.8).

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1648 Serverless Execution
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1070 Indicator Removal
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1555 Credentials from Password Stores
- T1056 Input Capture
- T1082 System Information Discovery
- T1057 Process Discovery
- T1087 Account Discovery
- T1005 Data from Local System
- T1119 Automated Collection
- T1021 Remote Services
- T1102 Web Service
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction
- T1491 Defacement
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1588 Obtain Capabilities

## Sources

- [Microsoft Security Blog: Detecting, investigating, and defending against the Trivy supply chain compromise](https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/)
- [CrowdStrike: From Scanner to Stealer — Inside the trivy-action Supply Chain Compromise](https://www.crowdstrike.com/en-us/blog/from-scanner-to-stealer-inside-the-trivy-action-supply-chain-compromise/)
- [Wiz: Trivy Compromised by TeamPCP — Supply Chain Attack Analysis](https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack)
- [Aqua Security: Trivy Supply Chain Attack — What You Need to Know (Updated)](https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/)
- [Socket: Trivy Under Attack Again — Widespread GitHub Actions Tag Compromise](https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise)
- [GitGuardian: Trivy March Supply Chain Attack Shows Where Secret Exposure Hurts Most](https://blog.gitguardian.com/trivys-march-supply-chain-attack-shows-where-secret-exposure-hurts-most/)
- [The Hacker News: Trivy Hack Spreads Infostealer via Docker, Triggers Worm and Kubernetes Wiper](https://thehackernews.com/2026/03/trivy-hack-spreads-infostealer-via.html)
- [The Hacker News: Trivy Supply Chain Attack Triggers Self-Spreading CanisterWorm Across 47 npm Packages](https://thehackernews.com/2026/03/trivy-supply-chain-attack-triggers-self.html)
- [SecurityWeek: Aqua's Trivy Vulnerability Scanner Hit by Supply Chain Attack](https://www.securityweek.com/aquas-trivy-vulnerability-scanner-hit-by-supply-chain-attack/)
- [Security Affairs: 44 Aqua Security Repositories Defaced After Trivy Supply Chain Breach](https://securityaffairs.com/189856/hacking/44-aqua-security-repositories-defaced-after-trivy-supply-chain-breach.html)
- [The Hacker News: Trivy Security Scanner GitHub Actions Breached, 75 Tags Hijacked](https://thehackernews.com/2026/03/trivy-security-scanner-github-actions.html)
- [Sysdig: TeamPCP Expands — Supply Chain Compromise Spreads from Trivy to Checkmarx](https://www.sysdig.com/blog/teampcp-expands-supply-chain-compromise-spreads-from-trivy-to-checkmarx-github-actions)
- [Infosecurity Magazine: Trivy Supply Chain Attack Expands With Compromised Docker Images](https://www.infosecurity-magazine.com/news/trivy-supply-chain-attack-expands/)
- [CyberPress: Trivy Supply Chain Attack Spreads Through Compromised Docker Hub Images](https://cyberpress.org/trivy-attack-hits-dockerhub/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0280