Cyber Incident Victim: Aqua Security

The initial compromise of the Trivy repository occurred in late February 2026 when attackers exploited a misconfigured GitHub Actions workflow that had been present in the codebase since October 2025. This workflow, triggered by external pull requests, operated with access to repository secrets, allowing the threat actors to steal a personal access token with write permissions. Using the stolen token, the attackers deleted existing releases, renamed the repository, and published a malicious Visual Studio Code extension. Although the Trivy maintainers rotated their credentials after this first incident, the rotation was incomplete, leaving some credentials still valid. The attackers later returned to the environment and introduced malicious commits into three components of the project: the official trivy-action GitHub Action, the setup-trivy helper action, and the Trivy binary itself. Backdoored artifacts were subsequently published to GitHub releases, Docker Hub, the GitHub Container Registry, and the Amazon Elastic Container Registry. Analysis by Wiz researchers showed that when the malicious binary is executed it launches the legitimate Trivy service in parallel with the credential‑stealing code. The attackers employed a tag manipulation technique similar to that used in the prior tj‑actions/changed-files compromise, which had affected approximately 23,000 repositories.

The impact of the Trivy breach was substantial, with the compromised components being used in over 10,000 continuous integration and continuous delivery workflows. As a result, more than 500,000 login credentials were exfiltrated, including cloud access tokens, SSH keys, and Kubernetes secrets. The stolen credentials were later linked to the TeamPCP cyber‑criminal gang, which specializes in large‑scale supply chain credential theft targeting developers and security tools. Sophos reported that at least one verified deployment of the Vect ransomware group used credentials obtained from TeamPCP, confirming a concrete ransomware consequence of the supply chain attack. The FBI issued a FLASH warning describing TeamPCP’s tactics, noting their use of malware families such as CanisterWorm, Sandclock, the self‑replicating Mini Shai‑Hulud worm, and its variant Miasma. The breach also fits into a broader pattern of attacks on developer tooling, including the GhostAction campaign that stole over 3,000 secrets from 327 GitHub users and an exploit of the nx npm package via a vulnerable pull_request_target workflow. Security firms Socket and Wiz traced the root cause of the Trivy incident to the incomplete credential rotation after the initial February breach, which allowed the attackers to regain persistence and inject the malicious code.

In response to the discovery, the Trivy maintainers publicly disclosed the attack and detailed the compromised artifacts. Security researchers from Socket and Wiz published analyses identifying the misconfigured workflow and the incomplete credential rotation as the enabling factors. The FBI’s FLASH alert highlighted the ongoing threat posed by TeamPCP and associated malware. Sophos researchers warned that the partnership between TeamPCP and the Vect ransomware group represents an industrialized model of ransomware that leverages stolen supply chain credentials. The maintainers noted that the breach could lead to further supply‑chain compromises if the exposed secrets are not addressed, and they urged recipients of the advisory to consider the integrity of their pipeline secrets. No additional speculative or advisory content is included beyond the facts presented in the source material.