---
title: "Trivy Supply-Chain Hijack: trivy-action Steals CI Secrets"
url: https://erroneo.us/security/briefs/trivy-action-teampcp-supply-chain-compromise/
description: "Mar 2026 TeamPCP hijack (CVE-2026-33634, KEV): 76 trivy-action tags, setup-trivy, Trivy 0.69.4-0.69.6 images stole CI secrets. Safe: 0.69.3, action 0.35.0."
type: security-brief
section: "Security Digest"
date_published: 2026-03-19
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-33634"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Trivy Supply-Chain Hijack: trivy-action Steals CI Secrets

**Verdict: Check exposure.** If any pipeline ran trivy-action by tag, setup-trivy, or Trivy 0.69.4 to 0.69.6 during the March 19-23, 2026 windows, every secret that job could see is burned; if you pinned SHAs, digests or 0.69.3, you were fine.

- **Who must act:** Teams whose CI ran aquasecurity/trivy-action by tag on March 19-20, 2026, setup-trivy unpinned, Trivy 0.69.4 from any channel or Docker Hub 0.69.5/0.69.6/latest on March 22-23, or the Checkmarx actions and Open VSX extensions on March 23.
- **Who can relax:** Users who pinned the action to a commit SHA after 2025-04-09, used images by digest, installed Trivy through the official Homebrew formula, or stayed on Trivy 0.69.3 or earlier were not affected.
- **Affected:** aquasecurity/trivy-action tags 0.0.1-0.34.2 (76 of 77 tags); aquasecurity/setup-trivy tags v0.2.0-v0.2.6; Trivy binary and images v0.69.4 (GitHub, deb/rpm, GHCR, ECR Public, Docker Hub, get.trivy.dev, aquasecurity/homebrew-trivy tap); Docker Hub aquasec/trivy 0.69.5 and 0.69.6, and 'latest' during exposure windows; checkmarx/ast-github-action and checkmarx/kics-github-action; Open VSX ast-results 2.53.0 and cx-dev-assist 1.7.0
- **Fixed:** Trivy v0.69.2 or v0.69.3; trivy-action 0.35.0 (or restored v-prefixed tags, e.g. v0.34.0); setup-trivy v0.2.6 (re-created)
- **CVEs:** CVE-2026-33634
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Grep workflows for trivy-action and setup-trivy references and check run logs from March 19-20, 2026
2. Pin actions to full commit SHAs and container images to digests
3. Rotate every secret available to affected jobs: cloud keys, GitHub PATs, registry creds, SSH keys, Kubernetes tokens, .env values
4. Search your GitHub org for tpcp-docs-* or docs-tpcp repos and data-<timestamp> releases
5. Block scan.aquasecurtiy.org, 45.148.10.212 and checkmarx.zone at egress
6. Verify Trivy binaries with cosign against the sigstore bundle

### How to check if you are affected

- grep -rnE 'aquasecurity/(trivy-action|setup-trivy)@' .github/workflows/
- trivy --version (0.69.4, 0.69.5 or 0.69.6 = compromised); docker images --digests aquasec/trivy
- GitHub org search: repositories named tpcp-docs-* or docs-tpcp
- Proxy/DNS logs: scan.aquasecurtiy[.]org, 45.148.10.212, checkmarx[.]zone; runner logs mentioning tpcp.tar.gz

## What happened

On March 19, 2026, an attacker used still-valid Aqua Security credentials to turn the popular Trivy vulnerability scanner into a credential stealer, through several channels at once. Aqua's advisory, [GHSA-69fq-xp46-6x23](https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23) (CVE-2026-33634), gives the details:

- The attacker force-pushed 76 of the 77 version tags in `aquasecurity/trivy-action` and all 7 tags in `aquasecurity/setup-trivy` to malicious commits.
- The attacker also pushed a commit that swapped `actions/checkout` for an imposter commit and disabled goreleaser validation, then tagged it as Trivy v0.69.4. That release shipped to GitHub Releases, deb/rpm, GHCR, ECR Public, Docker Hub, `get.trivy.dev` and a custom Homebrew tap.
- On March 22, separately stolen Docker Hub credentials were used to push malicious `0.69.5` and `0.69.6` images.

The injected code runs before the real scan, so pipelines looked normal. It dumps the GitHub `Runner.Worker` process memory, sweeps more than 50 paths for SSH keys, cloud and Kubernetes credentials, Docker configs and `.env` files, and encrypts the haul with AES-256-CBC wrapped in RSA-4096. It sends the data to the typosquat `scan.aquasecurtiy.org`. If that fails and a PAT is available, it creates a public `tpcp-docs-*` repo on the victim's account and uploads the data there. The root cause was an incomplete fix for a late-February intrusion: credential rotation after the March 1 disclosure "was not atomic", so a token that had not yet been revoked could read the new secrets.

The stealer calls itself "TeamPCP Cloud stealer" ([The Hacker News](https://thehackernews.com/2026/03/trivy-security-scanner-github-actions.html)). Four days later the same tooling hit `checkmarx/ast-github-action`, `checkmarx/kics-github-action`, and the Open VSX extensions `ast-results` 2.53.0 and `cx-dev-assist` 1.7.0, exfiltrating to `checkmarx[.]zone` ([THN](https://thehackernews.com/2026/03/teampcp-hacks-checkmarx-github-actions.html)). Stolen data from this spree reportedly fed later npm compromises.

## Who is affected

Aqua lists these exposure windows (UTC): trivy-action tags 0.0.1-0.34.2 from about 17:43 on March 19 to 05:40 on March 20 (about 12 hours); setup-trivy for about 4 hours; Trivy v0.69.4 from 18:22 to 21:42 on March 19; Docker Hub 0.69.5/0.69.6 and `latest` from 15:43 on March 22 to 01:40 on March 23. Workflows that SHA-pinned trivy-action to commits from before 2025-04-09 could still pull a malicious setup-trivy. CISA added CVE-2026-33634 to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) on March 26, 2026.

## Do you really need to act?

This one hit security teams specifically, because Trivy runs in exactly the pipelines that hold deploy keys. If a job ran inside a window, assume it leaked every secret it had, including `GITHUB_TOKEN` scope, cloud OIDC sessions and registry credentials. The windows were short, though, and the clean signals are clear: a SHA pin to a recent commit, an image digest, the official Homebrew formula (built from source), or Trivy 0.69.3 or earlier means you were not exposed. Seven months on, the work is an audit and a rotation, plus fixing the tag-pinning habit that made this possible.

## What to do now

1. Find references: `grep -rnE 'aquasecurity/(trivy-action|setup-trivy)@' .github/workflows/`. Then pull Actions run logs for March 19-20, 2026, using `gh run list --workflow <file> --created 2026-03-19..2026-03-23`.
2. Move to trivy-action `0.35.0` (immutable) or a restored `v`-prefixed tag, setup-trivy `v0.2.6`, and Trivy `v0.69.3` or later clean releases. Pin by full SHA and digest.
3. Rotate everything the affected jobs could reach: cloud keys and roles, GitHub PATs and app keys, registry credentials, SSH deploy keys, kubeconfigs, and database passwords.
4. Hunt for `tpcp-docs-*` or `docs-tpcp` repos and `data-<timestamp>` releases in your org. Delete them after preserving evidence.
5. Verify any Trivy binary you keep with `cosign verify-blob` against its sigstore bundle, and check that the Rekor timestamp predates March 19.

## How to tell if you were hit

`trivy --version` reporting 0.69.4, 0.69.5 or 0.69.6 means you ran a compromised build. Compare image digests with the advisory's IOC list (for example, the `0.69.4` tag is `sha256:27f44623…eef3`). Network indicators: `scan.aquasecurtiy[.]org`, `45.148.10.212`, `checkmarx[.]zone`, and `tpcp.tar.gz` in runner output. On developer machines that ran 0.69.4, check for an unexpected systemd user service, which the malware uses for persistence.

## Timeline

- Mar 1, 2026 — Disclosure of an earlier Trivy intrusion; credential rotation is incomplete.
- Mar 19, 2026 — Tags hijacked from about 17:43 UTC; v0.69.4 published at 18:22 UTC.
- Mar 21, 2026 — Aqua publishes GHSA-69fq-xp46-6x23.
- Mar 22, 2026 — Malicious Docker Hub images 0.69.5 and 0.69.6 pushed (removed about 10 hours later).
- Mar 23, 2026 — Checkmarx actions and Open VSX extensions compromised with the same stealer.
- Mar 26, 2026 — CISA adds CVE-2026-33634 to KEV.

## Sources

1. [Aqua Security / GitHub — GHSA-69fq-xp46-6x23 Trivy supply chain compromise](https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23)
2. [CISA — Known Exploited Vulnerabilities Catalog (CVE-2026-33634)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
3. [The Hacker News — Trivy security scanner GitHub Actions breached, 75 tags hijacked](https://thehackernews.com/2026/03/trivy-security-scanner-github-actions.html)
4. [The Hacker News — TeamPCP hacks Checkmarx GitHub Actions using stolen CI credentials](https://thehackernews.com/2026/03/teampcp-hacks-checkmarx-github-actions.html)

---
Source page: https://erroneo.us/security/briefs/trivy-action-teampcp-supply-chain-compromise/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt