2026-03-19 · 2026-Q1
Trivy GitHub Action Compromise by TeamPCP
Outside the model: Adjacent ecosystem Agent tooling was not the attack surface, so no layer applies.
- Fixable:
- Yes, vendor patch
- Vendor response:
- Unknown
- In the wild:
- Yes
Target
Aqua Security Trivy scanner
Impact
76 of 77 version tags redirected to malicious commits; Runner.Worker memory dumped; SSH, cloud, K8s secrets harvested; 1,000+ SaaS environments compromised downstream
Root Cause
Service account compromise via prior incompletely remediated incident
Sources
Related incidents
- LiteLLM Supply Chain Attack by TeamPCP (2026-03-24)