TeamPCP Compromises Trivy Releases and GitHub Actions to Steal Credentials
Summary
A TeamPCP supply-chain attack compromised Trivy releases and GitHub Actions, stealing CI/CD credentials and secrets. Wiz advises auditing affected versions and workflows, checking for exfiltration artifacts, and pinning actions to full commit SHAs.
Key points
- Attackers used retained access after an earlier incident to compromise Trivy v0.69.4, trivy-action, and setup-trivy; malicious Trivy images 0.69.5 and 0.69.6 were also published.
- Malicious GitHub Actions harvested runner memory, SSH keys, cloud credentials, Kubernetes tokens, and other secrets, then encrypted and exfiltrated them.
- The malware could create a tpcp-docs repository in a victim’s GitHub account as a fallback for stolen data.
- The Trivy binary also collected environment and filesystem credentials and could install a persistent systemd user service on developer machines.
- The attackers stole Aqua credentials, including GPG keys and Docker Hub, Twitter, and Slack credentials; malicious workflows were also pushed to related repositories.
- Aqua removed the malicious artifacts and published an advisory. Wiz recommends auditing affected Trivy versions and workflow runs, checking for tpcp-docs repositories, and pinning GitHub Actions to full commit SHAs.
Article Details
- Attack Vectors
- Compromised project and service-account access was used to push malicious commits and workflows to Trivy, trivy-action, setup-trivy, tfsec, and traceeshark.
- Malicious GitHub Action tags and Trivy release artifacts delivered credential-stealing payloads to downstream workflows and systems.
- The Trivy binary harvested environment variables and filesystem credentials, while the Actions payload also read Runner.Worker process memory and searched for SSH, cloud, Kubernetes, and cryptocurrency-wallet secrets.
- Stolen data was encrypted and exfiltrated to attacker-controlled infrastructure; fallback paths included creating a tpcp-docs repository in the victim's GitHub account.
- On developer machines, the malicious binary attempted persistence through a systemd user unit and Python dropper, which polled a fallback location for a payload.
- Defensive Notes
- Audit use or execution of Trivy v0.69.4 and the malicious Trivy container images, and remove affected artifacts.
- Review workflows referencing aquasecurity/trivy-action and aquasecurity/setup-trivy, especially runs from March 19–20; inspect the Run Trivy and Setup environment steps.
- Search GitHub organizations for unexpected tpcp-docs repositories and hunt for the listed network and file indicators.
- Pin GitHub Actions to full commit SHA hashes rather than movable version tags.
- Rotate credentials and secrets that may have been exposed, including SSH, cloud, Kubernetes, GPG, Docker Hub, Twitter, and Slack credentials.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | scan[.]aquasecurtiy[.]org | Typosquatted C2 domain used to deliver credential-stealing code and receive exfiltrated data. |
| HOSTNAME | plug-tab-protective-relay[.]trycloudflare[.]com | Cloudflare Tunnel C2 used for exfiltration from malicious GitHub Actions. |
| HOSTNAME | tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io | ICP-hosted fallback polled by the persistence script for a payload. |
| IPV4 | 45[.]148[.]10[.]212 | Resolution address reported for the typosquatted C2 domain. |
| SHA256 | 0880819ef821cff918960a39c1c1aada55a5593c61c608ea9215da858a86e349 | Hash listed for a malicious Windows-64bit artifact. |
| SHA256 | 6328a34b26a63423b555a61f89a6a0525a534e9c88584c815d937910f1ddd538 | Hash listed for a malicious macOS-ARM64 artifact. |
| SHA256 | 822dd269ec10459572dfaaefe163dae693c344249a0161953f0d5cdd110bd2a0 | Hash listed for a malicious Linux-64bit artifact. |
| SHA256 | 887e1f5b5b50162a60bd03b66269e0ae545d0aef0583c1c5b00972152ad7e073 | Hash listed for a malicious FreeBSD-64bit artifact. |
| SHA256 | bef7e2c5a92c4fa4af17791efc1e46311c0f304796f1172fce192f5efc40f5d7 | Hash listed for a malicious Linux-ARM artifact. |
| SHA256 | d5edd791021b966fb6af0ace09319ace7b97d6642363ef27b3d5056ca654a94c | Hash listed for a malicious Linux-s390x artifact. |
| SHA256 | e6310d8a003d7ac101a6b1cd39ff6c6a88ee454b767c1bdce143e04bc1113243 | Hash listed for a malicious macOS-64bit artifact. |
| SHA256 | e64e152afe2c722d750f10259626f357cdea40420c5eedae37969fbf13abbecf | Hash listed for a Linux-ARM64 artifact; the article marks this artifact unconfirmed. |
| SHA256 | ecce7ae5ffc9f57bb70efd3ea136a2923f701334a8cd47d4fbf01a97fd22859c | Hash listed for a malicious Linux-PPC64LE artifact. |
| SHA256 | f7084b0229dce605ccc5506b14acd4d954a496da4b6134a294844ca8d601970d | Hash listed for a malicious Linux-32bit artifact. |
MITRE ATT&CK
T1059.006 · PythonThe persistence dropper was written as a Python script and executed by a systemd unit.T1071.001 · Web ProtocolsThe malware used HTTP POST requests to transmit data to its C2 domain.T1543.002 · Systemd ServiceOn developer machines, the malware created a systemd user unit to persistently run its Python script.T1552.001 · Credentials In FilesThe payload searched the filesystem for SSH private keys and other credentials.T1552.005 · Cloud Instance Metadata APIThe malware collected cloud credentials, including AWS, GCP, and Azure credentials.T1552.007 · Container APIThe GitHub Actions payload harvested secrets from Runner.Worker process memory.T1560.001 · Archive via UtilityThe malware compressed collected data into tpcp.tar.gz before exfiltration.T1567.001 · Exfiltration to Code RepositoryThe Actions payload could upload stolen credentials as a release asset in a newly created GitHub repository.
Threat Actors
Malware
Vendors
Products
Docker Hub22, 21:40 UTC: ~16:00 UTC, attackers were able to publish malicious images of Trivy (0.69.5, 0.69.6) to Docker Hub. The attacker has also demonstrated continued access to Aqua by publishing internal Aqua repositoriesECRto 45.148.10.212), and backdoored binaries being published to GitHub Releases, Docker Hub, GHCR, and ECR. The maintainers have since removed these malicious artifacts.GHCRresolving to 45.148.10.212), and backdoored binaries being published to GitHub Releases, Docker Hub, GHCR, and ECR. The maintainers have since removed these malicious artifacts.GitHub ActionsTrivy vulnerability scanner, injecting credential-stealing malware into official releases and GitHub Actions. While Aqua reports they have since removed the malicious releases, organizations using Trivy shouldsetup-trivymultiple components of the Trivy project: the core scanner, the trivy-action GitHub Action, and the setup-trivy GitHub Action.tfsecalso compromised the aqua-bot service account and then abused their access push malicious workflows to tfsec, traceeshark, and trivy-action and steal additional credentials from Aqua (including GPG keys andtraceesharkthe aqua-bot service account and then abused their access push malicious workflows to tfsec, traceeshark, and trivy-action and steal additional credentials from Aqua (including GPG keys and credentials forTrivyOn March 19, 2026, threat actors compromised Aqua Security's Trivy vulnerability scanner, injecting credential-stealing malware into official releases and GitHub Actions. While Aqua reports they have since removed thetrivy-actionTrivy. The attack compromised multiple components of the Trivy project: the core scanner, the trivy-action GitHub Action, and the setup-trivy GitHub Action.