Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack

On March 19, 2026, threat actors injected credential-stealing malware into Aqua Security’s Trivy scanner and related GitHub Actions. Learn how "TeamPCP" executed this breach and how to audit your environment.

Update March 23, 17:40 UTC: Wiz Research hasidentified a parallel compromiseofkics-github-actionOn March 19, 2026, threat actors compromised Aqua Security'sTrivyvulnerability scanner, injecting credential-stealing malware into official releases and GitHub Actions. WhileAqua reportsthey have since removed the malicious releases, organizations using Trivy should audit their environments immediately.

Update March 22, 13:15 UTC: Wiz Research continues to track TeamPCP activity following the initial Trivy compromise. The threat actor has expanded operations to the npm ecosystem via a worm ("CanisterWorm") leveraging stolen publish tokens. Additionally, the ICP-hosted fallback C2 (tdtqy-oyaaa-aaaae-af2dq-cai) is now actively serving an iteratively developed payload (kamikaze.sh). Aqua has published ablog postand aGitHub Security Advisory.

Update March 22, 21:40 UTC:~16:00 UTC, attackers were able to publish malicious images of Trivy (0.69.5,0.69.6) to Docker Hub. The attacker has also demonstrated continued access to Aqua by publishing internal Aqua repositories publicly on GitHub. As of 21:31 UTC, the IPC Canister has been made "Unavailable Due to Policy Violation." We continue to monitor the situation.Update March 23, 19:26 UTC:Aqua's blog post has beenupdated with additional details.Note:this incident is distinct from the previous instance earlier this month, whereMegaGame10418exploited a PWN request, that was also later flagged byhackerbot-claw. Customers can refer tothe Threat Center Advisory on the previous incident.

Wiz Research, in concert with other industry parties, identified a multi-faceted supply chain attack targeting Aqua Security's Trivy. The attackcompromised multiple components of the Trivy project: the core scanner, thetrivy-actionGitHub Action, and thesetup-trivyGitHub Action.

The attack was conducted withaccess retained following incomplete containment of the earlier incident.The threat actor,self-identifying as TeamPCP, made imposter commits that were pushed toactions/checkout(while spoofing userrauchg) and toaquasecurity/trivy(while spoofing userDmitriyLewen). At 17:43:37 UTC, the Trivy repository’sv0.69.4tag was pushed, triggering a release. This resulted in a malicious checkout that fetchedcredential stealer codefrom a typosquatted domain (scan.aquasecurtiy[.]org, resolving to45.148.10.212), and backdoored binaries being published to GitHub Releases, Docker Hub, GHCR, and ECR. The maintainers have since removed these malicious artifacts.

The attacker also compromised theaqua-botservice account and then abused their access push malicious workflows totfsec,traceeshark, andtrivy-actionand steal additional credentials from Aqua (including GPG keys and credentials for Docker Hub, Twitter, and Slack). These secrets were exfiltrated to a Cloudflare Tunnel C2 (plug-tab-protective-relay.trycloudflare.com). Furthermore,75 out of 76trivy-actiontags were force-pushed to malicious versions, and 7setup-trivytags were force-pushed as well.

The malicious versions of these Actions run a tool self-described as "TeamPCP Cloud stealer", which dumpsRunner.Workerprocess memory, harvests SSH, cloud, and K8s secrets, encrypts the data (using AES-256+RSA-4096), and exfiltrates it to a remote server. The malware is configured to create a repository namedtpcp-docsin the victim's GitHub account as a fallback method.

The attacker injected the same three-stage payload into bothtrivy-action(inentrypoint.sh) andsetup-trivy(inaction.yaml). When a downstream workflow executed either action, the payload ran on the victim's GitHub Actions runner:

Collection: The malware scraped memory from the Runner.Worker process by reading/proc/<pid>/memand searching for the pattern{"value":"<secret>","isSecret":true}. It also swept the filesystem for SSH keys, cloud credentials  (AWS, GCP, Azure), Kubernetes tokens, and cryptocurrency wallets across 50+ sensitive file paths.

Encryption: Harvested credentials were encrypted using AES-256-CBC with RSA-4096 hybrid encryption and bundled intotpcp.tar.gz

Exfiltration: The malware transmitted the encrypted bundle to a typosquatted domain (scan.aquasecurtiy[.]org). As a fallback, it could create atpcp-docsrepository in the victim's GitHub account and upload the stolen credentials  as a release asset.

When the malicious binary is executed it starts both the legitimate trivy service and the malicious code in parallel. In our initial analysis the malicious code exfiltrates secrets with a primary and backup mechanism. If it detects it is on a developer machine it additionally writes a base64 encoded python dropper for persistence.

The malicious process gathers environmental variables, sweeps the system for any credentials stored in the filesystem and enumerates the network interface. It then compresses and encrypts the data and attempts to exfiltrate it via post request tohttps://scan.aquasecurtiy[.]org. If that fails (returns a non-2xx status code), the malware then attempts to use a stolen GITHUB_TOKEN to create a repotpcp-docsand post the data there.

The malicious code attempts to identify if it is on a developer machine by checking if the environmental variableGITHUB_ACTIONS != “true”. If that check passes, the malware attempts to create persistence by writing a python script as~/.config/systemd/user/sysmon.pyand creating a systemd unit that persistently runs the python script.

sysmon.pyinitially sleeps for five minutes and then pollshttps://tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io/. If a non-youtube link is found there the dropper downloads to/tmp/pglogand executes it in a new session.

At the time of analysis (10:30 AM EST/15:30 UTC) the malicious site was set to a RickRoll, but it could be changed by the attacker at any time.

Audit Trivy versions: Check whether your organization pulled or executed Trivyv0.69.4from any source (GitHub Releases, container registries, etc.). Remove any affected artifacts immediately.

Audit GitHub Action references: Review workflows usingaquasecurity/trivy-actionoraquasecurity/setup-trivy. If you referenced a version tag rather than a SHA, check workflow run logs from March 19-20 for signs of compromise. Specifically, you can look in theRun Trivystep oftrivy-actionand theSetup environmentstep ofsetup-trivy.

Search for exfiltration artifacts: Look for repositories namedtpcp-docsin your GitHub organization, which may indicate successful exfiltration via the fallback mechanism. Hunt based on the IOCs provided below.

Long-term hardening:Pin GitHub Actions to full SHA hashes, not version tags. Version tags can be moved to point at malicious commits, as demonstrated in this attack.

Wiz customers should refer to and monitor the advisory in theWiz Threat Centerfor ongoing guidance, pre-built queries, and references to relevant detections they can use to assess the risk  in their environment.

Worried you’ve been impacted?Connect with the Wiz Incident Response team.

Learn more about SITFhere.

Credit to Socket for compiling this data and making it easily available athttps://socket.dev/supply-chain-attacks/trivy-github-actions-compromise

Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets

20 Days Later: Trivy Compromise, Act II

Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised

Trivy Security incident 2026-03-19

This post will look at the past 20 years of cloud security research, separating the two decades into eras with important milestones defined that resulted in the change of one era to the next.

Welcoming a new era of Cloud and AI Security.

Identify real AI risk by connecting signals in context across the layers of AI applications.

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings