TeamPCP Compromised Trivy and Turned CI/CD Pipelines Into Credential Theft Channels

A supply-chain attack against Aqua Security’s Trivy ecosystem let attackers publish malicious artifacts and hijack GitHub Action tags, turning a widely used security scanner into a credential stealer. Reporting indicates the intrusion began with abuse of a misconfigured GitHub Actions workflow and theft of privileged credentials, followed by incomplete containment that left residual access in place. Attackers then poisoned aquasecurity/trivy-action by force-updating 75 of 76 tags, compromised setup-trivy, and published a backdoored Trivy v0.69.4 release; later activity also pushed malicious Docker Hub images 0.69.5 and 0.69.6. The malware harvested GitHub tokens, cloud credentials, SSH keys, Kubernetes secrets, Docker configs, and other CI/CD data from runners and developer environments, encrypted the loot, and exfiltrated it to attacker-controlled infrastructure or fallback GitHub repositories such as tpcp-docs.

Researchers and vendor advisories linked the campaign to TeamPCP and described it as an expanding, multi-stage operation that also included a brief OpenVSX compromise of the Trivy VS Code extension, defacement of 44 repositories in Aqua Security’s internal aquasec-com GitHub organization, and follow-on compromises affecting Checkmarx tooling and the LiteLLM PyPI package. Aqua removed malicious artifacts, revoked tokens, restored safe references, and said commercial products were not affected, while GitHub and public advisories identified safe versions including Trivy 0.69.2/0.69.3, trivy-action 0.35.0, and setup-trivy 0.2.6. U.S. CISA added CVE-2026-33634 to the KEV catalog, and incident responders warned organizations that ran affected versions to assume full pipeline compromise, rotate all accessible secrets, audit workflow logs and GitHub activity, and pin GitHub Actions to immutable commit SHAs.