New: Major version 1.0 officially released
New: Major version 1.0 officially released
New: Major version 1.0 officially released
New: Major version 1.0 officially released
New: Major version 1.0 officially released
How TeamPCP exploited Aqua Security's Trivy scanner to construct a cascading supply chain compromise affecting five software ecosystems within fourteen days.
March 25, 2026
4 Min Reads
Endura Security
A threat group designated TeamPCP exploited Aqua Security's Trivy vulnerability scanner - widely trusted across thousands of organizations - to construct a cascading supply chain compromise affecting five software ecosystems within fourteen days. The incident began with a compromised credential in late February 2026 and ultimately compromised LiteLLM on PyPI, a package downloaded approximately 95 million times monthly and present in one-third of cloud environments globally.
The vulnerability originated from improper configuration of a pull_request_target GitHub Actions workflow within the aquasecurity/trivy repository. An AI-powered bot account called hackerbot-claw (established February 20) exploited this flaw to steal a privileged Personal Access Token from the aqua-bot service account. By February 28, this compromised PAT enabled repository manipulation - the attackers privatized the repository, deleted GitHub Releases spanning v0.27.0 through v0.69.1, and pushed malicious content to the Trivy VS Code extension on Open VSX.
Aqua disclosed this initial breach March 1 through GitHub Discussion #10265 and rotated credentials. However, the rotation occurred gradually over multiple days rather than simultaneously. This operational gap permitted attackers to capture newly issued secrets, preserving persistent access despite remediation efforts.
At 17:43 UTC on March 19, the primary assault commenced using still-valid compromised credentials:
Attackers force-pushed 76 of 77 version tags in aquasecurity/trivy-action and all 7 tags in aquasecurity/setup-trivy to malicious commits containing a Python credential stealer. Only v0.35.0 survived, protected by GitHub's immutable releases feature enabled March 4. By moving existing tags rather than creating new ones, the operation evaded notifications that would have alerted maintainers.
A malicious commit substituted the actions/checkout reference with an impostor that downloaded malicious Go source files from a typosquatted domain. The attacker appended --skip=validate to goreleaser to circumvent validation, then tagged the commit as v0.69.4. This triggered the legitimate release pipeline, distributing compromised binaries across GitHub Releases, Docker Hub, GHCR, Amazon ECR, Homebrew, package managers, and the get.trivy.dev installer.
When the original incident discussion gained visibility, the attacker deleted it. Subsequent security researcher discussion #10420 was flooded with 17+ spam accounts posting generic praise within seconds. Two accounts posted taunts: "sugma and ligma, teampcp owns you."
The malicious v0.69.4 binary remained accessible for approximately 3.3 hours (18:22-21:42 UTC), while compromised trivy-action tags persisted roughly 12 hours. Over 10,000 GitHub workflow files reference trivy-action.
The credential-stealing payload operated in multiple layers. Upon invocation through compromised Trivy actions or binaries, malicious code executed before legitimate scanning logic, ensuring workflows appeared normal while covertly extracting secrets.
Three core operations:
Process Memory Dumping: Via /proc/<pid>/mem access, the malware extracted secrets from GitHub Actions Runner.Worker and Runner.Listener processes, bypassing GitHub's log masking mechanisms.
Filesystem Credential Sweep: Systematic scanning across 50+ paths harvested SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens, Docker configurations, .env files, database credentials, npm tokens, and cryptocurrency wallets.
Data Exfiltration: Harvested data was encrypted using AES-256-CBC with RSA-4096 hybrid encryption, packaged as tpcp.tar.gz, and transmitted via HTTP POST to the typosquatted domain scan.aquasecurtiy.org.
A sophisticated fallback mechanism existed: if primary C2 infrastructure failed and a GITHUB_PAT was accessible, the malware created a public repository named tpcp-docs on the victim's GitHub account and uploaded stolen data as release assets. The binary also installed a persistent stage-1 loader at ~/.config/sysmon.py that polled C2 servers every 50 minutes using Internet Computer Protocol blockchain canisters as dead-drop resolvers - a novel technique rendering traditional domain takedowns ineffective.
Each compromised environment yielded credentials unlocking subsequent targets, creating a chain reaction across five ecosystems in five days:
After initial cleanup, attackers redirected the Docker Hub latest tag to compromised content. March 22 saw direct image pushes (v0.69.5 and v0.69.6) using separately compromised Docker Hub credentials - no corresponding GitHub tags existed, complicating detection.
Using the compromised Argon-DevOps-Mgt service account, attackers defaced all 44 repositories in Aqua Security's internal aquasec-com organization within a scripted 2-minute operation, renaming repositories with "tpcp-docs-" prefixes and exposing proprietary materials including Tracee, internal Trivy forks, CI/CD configurations, and Kubernetes operators.
Stolen npm publishing tokens enabled deployment of a self-propagating worm across the npm ecosystem. The worm harvested npm tokens from compromised environments, enumerated publishable packages, incremented patch versions, injected payload, and republished - propagating to 141+ malicious artifacts across 66+ unique packages. This represented the first documented npm worm leveraging ICP blockchain canisters for command-and-control.
All 35 tags within Checkmarx/kics-github-action and ast-github-action v2.3.28 were compromised using stolen CI/CD secrets, along with two OpenVSX extensions.
Malicious LiteLLM versions 1.82.7 and 1.82.8 appeared on PyPI, representing the most impactful downstream casualty.
LiteLLM's CI/CD pipeline included a security scanning step (ci_cd/security_scans.sh) that installed Trivy via sudo apt-get install trivy without version pinning. When the compromised Trivy binary executed within the GitHub Actions runner, it scraped process memory extracting the PYPI_PUBLISH_PASSWORD in plaintext.
Malicious LiteLLM packages contained a three-stage credential stealer with dual delivery mechanisms. Version 1.82.7 embedded base64-encoded payload in litellm/proxy/proxy_server.py activating when litellm.proxy was imported. Version 1.82.8 escalated dramatically by adding a litellm_init.pth file to site-packages/ - a mechanism executing on every Python interpreter startup, including pip, Jupyter notebooks, IDEs, and test suites, without explicit import requirements.
The payload harvested SSH keys, all environment variables, cloud provider credentials (with full IMDSv2 signing support for AWS), Kubernetes secrets across all namespaces, cryptocurrency wallets, and additional sensitive data. It deployed a Kubernetes lateral movement toolkit creating privileged alpine:latest pods on every cluster node in kube-system, mounting host filesystems. The C2 domain was models.litellm.cloud - convincingly mimicking LiteLLM's legitimate infrastructure.
Discovery occurred accidentally when Callum McMahon at FutureSearch tested a Cursor MCP plugin pulling LiteLLM as a transitive dependency. His machine became unresponsive due to RAM exhaustion - the .pth mechanism fires on every Python subprocess, and since the payload itself spawns Python, it created an accidental fork bomb.
The malicious versions remained available approximately 3 hours before PyPI quarantine.
Security tools as prime targets: A vulnerability scanner designed to protect CI/CD pipelines became the vector for one of history's most damaging supply chain attacks. Organizations diligently running security scans became more vulnerable than those abstaining - their scanning step constituted the entry point. This inverts traditional security calculus, demanding security tooling itself be treated as high-value attack surface.
Incomplete incident response dangers: Aqua's non-atomic credential rotation after the February breach directly enabled the March 19 assault. Partial remediation created false confidence while leaving doors open. Every organization must treat credential rotation as all-or-nothing, assuming persistent access until proven otherwise.
Git tag mutability vulnerabilities: GitHub Actions' default reliance on mutable tags rather than immutable commit SHAs represents a documented architectural weakness exploited in two major incidents (tj-actions March 2025, Trivy March 2026). The mitigation proves straightforward: pin all GitHub Actions to complete commit SHA hashes, not version tags.
Cascading credential theft patterns: TeamPCP progressed from Trivy to Docker Hub to npm to Checkmarx to LiteLLM in five days, with each compromise yielding credentials for subsequent targets. This chain-reaction model demonstrates how a single compromised CI/CD environment exposes an organization's entire software publishing infrastructure. Organizations must enforce strict credential isolation - PyPI tokens, npm tokens, Docker credentials, and GitHub PATs must never coexist in identical runner environments.
AI infrastructure as emerging targets: LiteLLM sits between applications and AI providers, often holding API keys for OpenAI, Anthropic, Azure, and dozens of additional services. Compromising such a gateway provides broad credential access across the entire AI stack. As AI tooling proliferates, this attack surface expands proportionally.
The Trivy-to-LiteLLM supply chain attack represents an inflection point. Each successive supply chain attack grows more sophisticated, cascades further, and exploits deeper trust relationships. Blockchain-based C2 infrastructure and AI-powered reconnaissance bots signal supply chain attacks entering a new phase where traditional defenses - domain takedowns, credential rotation, package quarantine - may prove insufficient. The most actionable approach demands architectural change: every dependency in CI/CD pipelines, especially security tools, requires pinning to immutable references, execution with minimal privileges, and runtime monitoring for anomalous behavior. The era of implicitly trusting security scanners has concluded.
Learn how Endura Security's eBPF-based platform provides runtime enforcement across your CI/CD pipelines and production workloads. Request a demo to see how kernel-level policy enforcement blocks credential theft, unauthorized network connections, and anomalous process execution, even when the compromised component is a package you trust.
Ready to put this into practice?
