Executive Summary
On March 19, 2026, the Trivy open-source vulnerability scanner ecosystem was compromised in a sophisticated supply chain attack attributed to TeamPCP (linked to the Shai-Hulud 2.0 campaign). The attackers exploited mutable GitHub tags to redirect users of 'trivy-action' and 'setup-trivy' to malicious commits and published a poisoned binary (v0.69.4). This allowed for the execution of a Python-based stealer within CI/CD pipelines.
This incident is critical because it weaponized a trusted security tool to harvest high-value credentials, including AWS/GCP/Azure tokens, Kubernetes secrets, and environment variables. The malware's ability to execute legitimate Trivy functions after exfiltration makes detection difficult for standard pipeline monitoring, requiring organizations to audit their GitHub Action pinning strategies and transition to immutable commit SHAs.