Executive Summary
On March 19, 2026, the threat actor TeamPCP executed a multi-faceted supply chain attack against Aqua Security's Trivy vulnerability scanner. By exploiting incomplete containment from a prior incident, the attackers compromised the core scanner repository, the `trivy-action` GitHub Action, and the `setup-trivy` GitHub Action. The attack involved spoofing legitimate maintainer identities to push malicious code and force-pushing tags for 75 out of 76 `trivy-action` versions to ensure widespread infection of downstream CI/CD pipelines.
The primary objective was large-scale credential theft. The injected malware, dubbed 'TeamPCP Cloud stealer', was designed to dump process memory from GitHub runners to extract secrets and sweep the filesystem for cloud, SSH, and Kubernetes credentials. Stolen data was exfiltrated to a typosquatted domain (`scan.aquasecurtiy[.]org`) or uploaded to a fallback repository named `tpcp-docs` within the victim's own GitHub organization. Additionally, if the malware detected it was running on a developer machine rather than a CI runner, it established persistence via a systemd unit and a Python-based dropper.