On March 19, 2026 at 17:43 UTC, TeamPCP force-pushed 76 of 77 version tags in aquasecurity/trivy-action and all 7 tags in aquasecurity/setup-trivy to point at malicious commits. Docker Hub images for trivy were poisoned simultaneously. The payload was injected into entrypoint.sh and executed BEFORE the legitimate Trivy scan - pipelines appeared to work normally (SARIF output uploaded, exit code 0, duration unchanged) while the stealer exfiltrated environment variables, GitHub Actions tokens, AWS/GCP/Azure credentials, npm publish tokens, and Docker Hub tokens. Per Aqua's post-incident review, the attack was made possible by incomplete remediation of an earlier February 2026 intrusion - credential rotation that did not cover all machine identities left TeamPCP with residual access to Trivy's release infrastructure. Exposure windows ranged 3-12 hours per component before rollback.

Aqua published advisory GHSA-69fq-xp46-6x23 and rotated affected credentials a second time. Microsoft Security Blog, Wiz, Palo Alto Networks, Legit Security, Sysdig (TeamPCP expansion to Checkmarx Actions), and Upwind all published detection guidance within days. Halcyon reported the campaign entered an extortion phase with the Vect ransomware operation publishing its first downstream victim using credentials linked to the Trivy compromise. The canonical defense is pinning GitHub Actions by full commit SHA (not by tag) and pinning Docker images by digest. Dependabot and Renovate now auto-pin Actions to SHA by default.