Loading malware…
Trivy is an open-source vulnerability scanner whose release and distribution ecosystem was compromised in March 2026 in a major software supply-chain attack attributed to TeamPCP. During the incident, attackers poisoned the Trivy binary release stream and associated GitHub Actions, including trivy-action and setup-trivy, turning trusted security tooling into a credential-stealing platform for CI/CD environments and developer systems.
The malicious Trivy release and action payloads harvested secrets from GitHub Actions runners by reading runner process memory and by collecting credentials from numerous filesystem locations. Stolen material included cloud credentials, container registry credentials, Kubernetes tokens, SSH material, environment files, database secrets, Terraform state, shell histories, and other sensitive artifacts commonly present in build environments. The malware packaged collected data, encrypted it with hybrid cryptography, and exfiltrated it to attacker-controlled infrastructure. If direct exfiltration failed, it could abuse a victim’s GitHub token to create repositories and upload stolen data as release assets, blending exfiltration into legitimate GitHub API traffic.
On non-CI Linux developer systems, the backdoored Trivy binary also attempted persistence by installing a user-level systemd service and polling for follow-on payloads, indicating post-compromise backdoor functionality beyond simple credential theft. The compromised binary reportedly executed legitimate Trivy functionality in parallel with the malicious logic, helping the attack evade immediate detection.
The Trivy compromise was a foundational event in a broader TeamPCP credential-chaining campaign. Secrets harvested from downstream pipelines were subsequently used to compromise additional ecosystems and projects, including npm, PyPI, OpenVSX, and other GitHub Actions. Public reporting tied the incident to downstream impacts at organizations whose build pipelines executed the poisoned Trivy components. The attack highlighted the risks of mutable tags, long-lived automation credentials, incomplete credential rotation, and unpinned dependencies in CI/CD pipelines.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
ownCloud published a security notice confirming their build infrastructure -- the systems producing container images and client binaries -- was affected by CVE-2026-33634 (the Trivy compromise).
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The prior operational cadence was aggressive -- a new target every 1-3 days (Trivy March 19, CanisterWorm March 20-22, Checkmarx March 23, LiteLLM March 24, Telnyx March 27).
On March 19, 2026, aquasecurity/trivy-action — a widely used GitHub Action for running the Trivy vulnerability scanner — was compromised for approximately 12 hours... a malicious trivy binary release (v0.69.4) was published for approximately 3 hours.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
...allowing the hackers to steal its secret API key and use that access to pivot to obtain data stored in the Commission’s AWS account.
...hackers acquired a secret API key associated with the European Commission’s AWS account... use that access to pivot to obtain data stored in the Commission’s AWS account.
two malicious versions of LiteLLM were published directly to PyPI... LiteLLM's PyPI publishing token was exposed through a poisoned Trivy binary running inside CI. The token was then used to upload weaponized packages without ever touching LiteLLM's source code or release workflow.
Late February — Attackers compromise Trivy, a widely-used open-source vulnerability scanning tool, planting malicious code within it. Early-to-Mid March — LiteLLM's CI/CD pipeline runs the compromised version of Trivy.
Besides the Trivy breach, TeamPCP has been linked to ransomware attacks and crypto-mining campaigns... The hackers have more recently been behind a systematic campaign of supply chain attacks compromising other open source security projects...
ownCloud published a security notice confirming their build infrastructure -- the systems producing container images and client binaries -- was affected by CVE-2026-33634 (the Trivy compromise). ownCloud confirms: no customer data compromised, no source code altered, impact limited to build systems only.
Reads GitHub Actions Runner worker memory (on Linux) — decodes a base64 Python script that locates the Runner.Worker process and reads its memory via /proc/<pid>/mem to extract secrets marked isSecret: true.
The poisoned Trivy binary ran inside the GitHub Actions runner and scraped process memory via /proc/<pid>/mem, bypassing GitHub's secret masking to extract the PYPI_PUBLISH_PASSWORD token in plaintext.
Reads GitHub Actions Runner worker memory (on Linux) — decodes a base64 Python script that locates the Runner.Worker process and reads its memory via /proc/<pid>/mem to extract secrets marked isSecret: true.
The poisoned Trivy binary ran inside the GitHub Actions runner and scraped process memory via /proc/<pid>/mem, bypassing GitHub's secret masking to extract the PYPI_PUBLISH_PASSWORD token in plaintext.
After exfiltration, the malware cleaned up all temporary files and launched the legitimate Trivy scan.
...allowing the hackers to steal its secret API key and use that access to pivot to obtain data stored in the Commission’s AWS account.
It iterated through th e /proc/ directory to isolate the PIDs for the .NET runtime powering the Runner.Worker process. Because the script inherited the runner’s user privileges, it read the /proc/<pid>/mem file descriptor , mapped the memory boundaries via /proc/<pid>/maps, and ran string-matching algorithms across the heap memory segments.
LiteLLM's CI/CD pipeline used a compromised version of the Trivy security scanner, leading to the exposure of PyPI publishing credentials... Attackers use the stolen credentials to upload two backdoored LiteLLM releases.
The attacker's script can easily read any of them with an environment lookup like os.environ.get('MY_SECRET') and send them back to an attacker without leaving evidence.
threat actors used the Trufflehog open source tool to find and validate stolen credentials. Then, TeamPCP performed reconnaissance ... After the organization downloaded a compromised version of Trivy, attackers stole an AWS API key ... From there, they used Trufflehog to discover more AWS credentials
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
CERT-EU said the credentials seemed to have been harvested through the Trivy supply-chain attack.
A security scanner whose compromise impacted downstream build infrastructure in the TeamPCP supply chain campaign.
Referenced as the compromised component in a supply chain incident affecting downstream build infrastructure, tied to CVE-2026-33634.
Mentioned as an earlier TeamPCP compromise target/wave in the broader supply-chain campaign timeline.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.