TeamPCP Campaign Expands From Trivy Compromise to npm Worm and Kubernetes Wiper
Summary
Researchers report that TeamPCP’s Trivy supply-chain compromise spread trojanized images and enabled repository defacements, CanisterWorm-infected npm packages, credential theft, backdoors, and Kubernetes-wiping payloads.
Key points
- Trivy Docker image versions 0.69.4–0.69.6 were reported as malicious and later removed; 0.69.3 was identified as the last known clean release.
- Researchers attributed the campaign to TeamPCP and said a compromised Aqua Security GitHub Actions credential enabled credential theft.
- A compromised Argon-DevOps-Mgt service account token was assessed with high confidence as the means of defacing 44 Aqua Security internal repositories.
- Attackers reportedly used stolen data to compromise dozens of npm packages and distribute the self-propagating CanisterWorm.
- A TeamPCP-attributed payload reportedly deploys privileged DaemonSets to wipe Iranian Kubernetes clusters; non-Iranian nodes may receive a CanisterWorm backdoor.
- The article advises avoiding affected Trivy versions, reviewing recent CI/CD executions, and securing exposed service account tokens.
Article Details
- Event Type
- Supply-chain compromise involving trojanized Trivy images and GitHub Actions, followed by repository defacement and downstream malware distribution.
- Impact
- Trivy versions 0.69.4–0.69.6 were distributed as malicious Docker images and later removed. The reported downstream activity includes defacement of 44 Aqua Security repositories, npm packages infected with CanisterWorm, credential theft and backdoor deployment, and wiping of Iranian Kubernetes clusters.
MITRE ATT&CK
T1021.004 · SSHThe article says a new wiper spreads through SSH using stolen keys.T1059.004 · Unix ShellThe Kubernetes-wiping payload is described as a shell script that runs system checks and destructive commands.T1195.002 · Compromise Software Supply ChainThe reported compromise used a compromised credential to push trojanized Trivy images and involved downstream npm package compromises.T1485 · Data DestructionThe reported payload wipes Iranian Kubernetes clusters and non-Kubernetes Iranian hosts.T1610 · Deploy ContainerThe payload reportedly deploys privileged DaemonSets across Kubernetes nodes.
People
Charlie EriksenAikido security researcher who described the reported Kubernetes payload behavior, including cluster wiping and backdoor installation.Paul McCartySecurity researcher who described forensic analysis of GitHub Events API data and assessed that a compromised service-account token was used to deface Aqua Security repositories.Philipp BurckhardtSocket security researcher who reported that new Trivy image tags contained indicators associated with the TeamPCP infostealer.
Threat Actors
Malware
Vendors
Products
Docker HubSecurity researchers found trojanized Trivy images and other malicious artifacts on Docker Hub following a Trivy supply-chain compromise that widened the blast radius across developer environments.GitHub ActionsThe campaign, attributed to TeamPCP, used a compromised Aqua Security GitHub Actions credential to push a credential stealer, deface repositories, infect npm packages with CanisterWorm, and deploy Kubernetes-wiping andKubernetesto push a credential stealer, deface repositories, infect npm packages with CanisterWorm, and deploy Kubernetes-wiping and backdoor payloads, so organizations should avoid affected Trivy versions and treat recentnpmAqua Security GitHub Actions credential to push a credential stealer, deface repositories, infect npm packages with CanisterWorm, and deploy Kubernetes-wiping and backdoor payloads, so organizations shouldTrivySecurity researchers found trojanized Trivy images and other malicious artifacts on Docker Hub following a Trivy supply-chain compromise that widened the blast radius across developer environments.