# Trivy GitHub Action + Docker images compromised - start of TeamPCP cascade

> Aqua Security's Trivy scanner was compromised on 19 March 2026 by the threat actor self-identifying as TeamPCP. The attacker force-pushed 76 of 77 tags in `aquasecurity/trivy-action` (only @0.35.0 survived) and all 7 tags in `aquasecurity/setup-trivy` to malicious commits, then published trojanised Trivy binary 0.69.4 + Docker images 0.69.5/0.69.6/latest. A stolen Argon-DevOps-Mgt service-account token seeded the downstream LiteLLM, Telnyx, Bitwarden CLI, and Checkmarx compromises.

- Published: 2026-03-19
- Severity: critical
- Kind: Compromise - A legitimate, already-used package, maintainer account, CI pipeline, or release tag was hijacked and a malicious version was published under a name people already depend on.
- Ecosystems: Docker, GitHub Actions
- Scope: 3 packages, 4 compromised versions
- Tags: ci-cd-compromise, credential-theft, maintainer-takeover, infostealer
- Threat actor: TeamPCP
- Also known as: TeamPCP Trivy cascade
- Detected by: Aqua Security, Microsoft Threat Intelligence
- Incident ID: github-actions-2026-03-19-trivy-teampcp-cascade

## Affected packages (3)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [aquasec/trivy](https://dependencywatch.io/package/docker/aquasec/trivy) | Docker | 0.69.4, 0.69.5, 0.69.6, latest |
| [aquasecurity/setup-trivy](https://dependencywatch.io/package/github-actions/aquasecurity/setup-trivy) | GitHub Actions |  |
| [aquasecurity/trivy-action](https://dependencywatch.io/package/github-actions/aquasecurity/trivy-action) | GitHub Actions |  |

## What happened

On `2026-03-19` the threat actor self-identifying as **TeamPCP** compromised Aqua Security and used the access to publish trojanised versions of the widely-used `Trivy` vulnerability scanner. The attacker force-pushed `76` of `77` tags in `aquasecurity/trivy-action` (only `@0.35.0` survived because it was pinned in a popular template), every one of the `7` tags in `aquasecurity/setup-trivy`, and pushed Docker images `aquasec/trivy:0.69.4`, `:0.69.5`, `:0.69.6`, and `:latest`. The trojanised binary `Trivy 0.69.4` was also pushed to GitHub releases.

## Mechanics

The injected code harvests environment variables and secret files from the host runner, then exfiltrates to `scan.aquasecurtiy.org` (note the typosquatted spelling) and `audit.checkmarx.cx`. A stolen `Argon-DevOps-Mgt` service-account token granted the attacker enough access to maintainer accounts at downstream vendors, seeding subsequent compromises.

## Blast radius

- An estimated `10,000+` GitHub Actions workflows pin Trivy by tag rather than commit SHA, so any pipeline that ran during the window of compromise executed the stealer.
- Direct downstream consequences traced to this single token theft: `LiteLLM` (PyPI, `2026-03-24`), `Telnyx` Python SDK, `Bitwarden CLI`, and the `Checkmarx KICS` / `ast-github-action` compromise on `2026-03-23`.
- TeamPCP later claimed roughly `500,000` stolen credentials across the cascade.

## Response

Aqua Security restored clean tags and rotated their signing infrastructure within hours of disclosure. Microsoft published detailed detection guidance on `2026-03-24`, including KQL queries for Defender for Cloud and Sentinel. The incident is now the canonical case study for *why* GitHub Actions should be pinned to immutable commit SHAs rather than tags.

## Impact

- CI/CD secrets (cloud, SSH, K8s tokens) harvested from any pipeline using a compromised tag
- ~10,000+ workflows pinned by tag rather than SHA were affected
- Stolen tokens seeded ≥4 subsequent package compromises across PyPI + npm

## What to do

1. Pin Trivy binary to `v0.69.3` or earlier; `trivy-action` to `v0.35.0` commit `57a97c7`; `setup-trivy` to `v0.2.6` commit `3fb12ec`
2. Rotate all CI/CD credentials reachable from any Trivy scan job since 19 March 2026
3. Hunt for `scan.aquasecurtiy.org` and `audit.checkmarx.cx` in egress logs
4. Switch GitHub Action references from tags to immutable commit SHAs as standard practice

## References

- [Detecting, investigating, and defending against the Trivy supply chain compromise](https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/) - Microsoft
- [Update: Ongoing Investigation and Continued Remediation (Trivy supply chain attack)](https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/) - Aqua Security
- [Trivy Compromised a Second Time - Malicious v0.69.4 Release, trivy-action and setup-trivy GitHub Actions Compromised](https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release) - Step Security

---

Canonical page: https://dependencywatch.io/incident/github-actions-2026-03-19-trivy-teampcp-cascade
Markdown version: https://dependencywatch.io/incident/github-actions-2026-03-19-trivy-teampcp-cascade.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).