Trivy supply-chain attack spreads to Docker Hub images and Aqua's GitHub org

The compromise of Aqua Security's Trivy scanner in March 2026 is one of the most consequential CI/CD supply-chain attacks so far. TeamPCP turned the security scanner that many pipelines run on every build into a credential stealer. They poisoned the release binary, force-pushed almost every trivy-action tag, pushed malicious Docker Hub images, and finally took over Aqua's internal GitHub organization. If any of your pipelines ran Trivy between 19 and 22 March 2026, treat that pipeline's secrets as stolen.

What happened

• Late February 2026: an attacker exploited a pull_request_target workflow misconfiguration in the Trivy repository and stole a privileged token (the aqua-bot PAT). Aqua disclosed this on 1 March and rotated credentials, but the rotation wasn't atomic, so some valid access survived.
• 19 March, ~17:43 UTC: using that access, the attacker published malicious Trivy v0.69.4 and force-pushed 76 of 77 aquasecurity/trivy-action tags and all 7 aquasecurity/setup-trivy tags to imposter commits. Aqua contained the binary within a few hours. The malicious action tags stayed live until early 20 March.
• 22 March: malicious Docker Hub tags 0.69.5 and 0.69.6 appeared with no matching GitHub release. Socket flagged them and noted that Docker Hub tags are mutable.
• 22 March, ~20:31 UTC: all 44 repositories in Aqua's internal aquasec-com organization were renamed with a tpcp-docs- prefix and made public. OpenSourceMalware assessed with high confidence that the attacker used the Argon-DevOps-Mgt service account. That account authenticated with a long-lived personal access token valid in both Aqua GitHub organizations, which the stealer had probably taken from a CI runner.

The payload, which researchers call the "TeamPCP Cloud stealer", collected GitHub tokens, SSH keys, cloud credentials and environment variables from runners. Stolen credentials then fed the next stages: CanisterWorm on npm, compromised Checkmarx GitHub Actions, and the LiteLLM PyPI releases. The issue is tracked as GHSA-cxm3-wv7p-598c and CVE-2026-33634. Aqua says its commercial products, which use a deliberately lagging fork, weren't affected, and it brought in incident response firm Sygnia.

Who is affected

• Workflows that used aquasecurity/trivy-action by tag (anything other than v0.35.0) between 19 March 17:43 and 20 March 05:40 UTC.
• Workflows that used aquasecurity/setup-trivy on 19 March between 17:43 and 21:44 UTC.
• Anyone who downloaded the Trivy v0.69.4 binary, or pulled aquasec/trivy:0.69.4, 0.69.5, 0.69.6 or latest during the window.
• Developer machines where the malicious binary ran outside CI.

What it means for developers and engineering teams

Three defaults that most teams rely on all failed here. First, tags are not versions. A Git tag such as @v0.28.0 or a Docker tag such as :0.69.3 is a mutable pointer. Force-pushing 76 tags changed what thousands of pipelines ran without a single workflow file changing. Only a full commit SHA or an image digest is immutable.

Second, security tools run with high privilege. Scanners are usually placed in jobs that also hold registry credentials, cloud deploy keys and publish tokens, because that's where the build output is. Any action in a job can read every secret exposed to that job.

Third, credential rotation has to be complete and atomic. Aqua rotated after the February incident, but some tokens were still valid, and one long-lived, cross-organization service-account PAT was enough to move from the public project into the company's private code. GitHub Apps with scoped installation tokens, or OIDC-federated short-lived credentials, would have made that move much harder.

What to do now

1. Find exposure: search workflow run logs for trivy-action and setup-trivy runs between 19 and 20 March, and container pulls of the bad tags.
2. Move to safe versions: Trivy v0.69.3 (or v0.69.2), trivy-action v0.35.0, setup-trivy v0.2.6, or later verified releases.
3. Rotate every secret that affected jobs could read: cloud keys, registry tokens, npm or PyPI publish tokens, SSH keys, kubeconfigs and GITHUB_TOKEN-adjacent PATs.
4. Pin actions by SHA, for example uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1, and let Dependabot or Renovate update the SHAs.
5. Pin images by digest (image@sha256:...), not by tag.
6. Search your organizations for repositories named tpcp-docs, which the stealer used as an exfiltration fallback.
7. On developer machines, check for ~/.config/systemd/user/sysmon.py and matching user units.
8. Split jobs so scanning runs without publish or deploy secrets, and restrict runner egress.

Related on TechLogHub

• GitHub Actions vs GitLab CI
• CI/CD
• Docker

Sources

• Aqua Security: Trivy supply chain attack, what you need to know
• BleepingComputer: Trivy supply-chain attack spreads to Docker, GitHub repos
• The Hacker News: Trivy hack spreads infostealer via Docker Hub
• OpenSourceMalware: TeamPCP supply chain campaign retrospective
• Security Affairs: 44 Aqua Security repositories defaced after Trivy supply chain breach