Public story · 2026-03-21 · source-backed

Trivy Scanner Compromised: 75 of 76 GitHub Actions Tags Hijacked

Issue

2026-03-21

Confidence

source-backed

Sources

Redaction

passed

Story

TeamPCP force-pushed malicious code into 75 of 76 version tags in aquasecurity/trivy-action, injecting a credential stealer into the widely-used vulnerability scanning GitHub Action. Version 0.69.4 runs both the legitimate scanner and malware that exfiltrates environment variables, API tokens, cloud credentials, and SSH keys to scan.aquasecurtiy[.]org (typosquat). Any CI/CD pipeline that ran a poisoned tag should be treated as fully compromised. Rotate all secrets immediately.

Source trail

TeamPCP force-pushed malicious code

Entities

Any CI GitHub Action GitHub Actions Tags Hijacked Rotate SSH TeamPCP Trivy Scanner Compromised Version

Provenance

Canonical issue: Ramsay Research Agent — Saturday, March 21, 2026
AI generated: no
Story unit: 2026-03-21-trivy-scanner-compromised-75-of-76-github-actions-tags-hijacked
Labels: source-backed, canonical briefing excerpt

Fetching from the wire…

Trivy Scanner Compromised: 75 of 76 GitHub Actions Tags Hijacked

Story

Related stories

Trivy Scanner Compromised: CanisterWorm Self-Propagating Across 47 npm Packages

The LiteLLM supply chain attack yields a 153GB dump: 433,909 files, 2,488 corporate domains, keys still live five months later

LiteLLM Got Backdoored. The Attack Vector? Their Own Security Scanner.

The Security Scanner Was the Attack Vector. 10,000 CI/CD Workflows Compromised.

CISA Confirms: Your AI Security Scanner Got Backdoored. Federal Deadline Is April 8.

Two poisoned LiteLLM releases drained credentials from 2,500 orgs and 434,000 CI/CD pipelines

Mercor Confirms 4TB Breach via LiteLLM Supply Chain Attack. If You Use LiteLLM, Check Your Versions Now.

TeamPCP Goes Multi-Ecosystem: CanisterWorm Hits npm, LAPSUS$ Collaboration Surfaces, and a Bug in the Attacker's Own Code Was the Only Thing That Caught It

Source trail

Entities

Provenance

Trivy Scanner Compromised: 75 of 76 GitHub Actions Tags Hijacked

Story

Related stories

Trivy Scanner Compromised: CanisterWorm Self-Propagating Across 47 npm Packages

The LiteLLM supply chain attack yields a 153GB dump: 433,909 files, 2,488 corporate domains, keys still live five months later

LiteLLM Got Backdoored. The Attack Vector? Their Own Security Scanner.

The Security Scanner Was the Attack Vector. 10,000 CI/CD Workflows Compromised.

CISA Confirms: Your AI Security Scanner Got Backdoored. Federal Deadline Is April 8.

Two poisoned LiteLLM releases drained credentials from 2,500 orgs and 434,000 CI/CD pipelines

Mercor Confirms 4TB Breach via LiteLLM Supply Chain Attack. If You Use LiteLLM, Check Your Versions Now.

TeamPCP Goes Multi-Ecosystem: CanisterWorm Hits npm, LAPSUS$ Collaboration Surfaces, and a Bug in the Attacker's Own Code Was the Only Thing That Caught It

Source trail

Entities

Provenance