TeamPCP Supply Chain Campaign
A multi-week, multi-ecosystem attack chain spanning GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX. Impacted so far: Aqua's Trivy, Checkmarx KICS, and LiteLLM.
Last updated:
Trivy (Aqua): The initial victim after incomplete containment following 03/01 PwnRequest. Attackers published malicious builds. (blog post, security advisory, GHSA-69fq-xp46-6x23)
KICS (Checkmarx): OpenVSX extension and GitHub Action hijacked via compromised account. Repo restored Mar 23. (Statement)
LiteLLM (BerriAI): PYPI_PUBLISH token harvested via Trivy in CI/CD. Versions 1.82.7/1.82.8 removed from PyPI. (Issue #24512 · PYSEC-2026-2)
Want a detailed analysis? Check out our blog posts: Trivy Compromised and TeamPCP Attacks KICS
February 27, 2026
Threat actor MegaGame10418 executed a Pwn Request against Trivy's CI, exploiting a vulnerable pull_request_target workflow to exfiltrate the aqua-bot PAT. Incomplete credential rotation enabled the current attacks.
Show details
Observed impact (per Aqua):
- Repository made private and renamed to
aquasecurity/private-trivy; empty repo pushed in its place - GitHub Releases v0.27.0–v0.69.1 deleted, including discussions and assets
- Malicious artifact pushed to Trivy's VSCode extension on Open VSIX marketplace, using former employee's token
Remediation:
Aqua removed the vulnerable workflow, revoked the malicious extension token, restored the repo, and republished v0.69.2. Container images and package manager installs were unaffected; binary downloads and Trivy Action were temporarily degraded.
What they missed:
Credential rotation "wasn't atomic and attackers may have been privy to refreshed tokens" — enabling the current flurry of attacks.
Initial Compromise
Imposter Commit to actions/checkout
Attacker creates a malicious commit impersonating rauchg (Guillermo Rauch) in the actions/checkout repository. Payload fetches malicious Go files from typosquatted C2 and injects them into the build.
Imposter Commit to aquasecurity/trivy
Attacker duplicates a prior legitimate contribution and impersonates DmitriyLewen. This malicious commit references the imposter checkout action, establishing the attack chain.
Malicious v0.69.4 Tag Pushed
Tag v0.69.4 pushed to trivy repository, pointing to the malicious commit. This triggers automated release workflows.
Malicious Releases Distributed
Automated workflows publish the malicious v0.69.4 release to multiple distribution channels, maximizing supply chain impact.
Lateral Movement via compromised aqua-bot identity
tfsec Workflow Compromised
Malicious workflow added to aquasecurity/tfsec using compromised aqua-bot identity. Workflow dumps secrets, then is reverted.
traceeshark Workflow Compromised
Same attack pattern applied to aquasecurity/traceeshark. Malicious workflow injected via compromised bot account.
trivy-action Workflow Compromised
Attack continues to aquasecurity/trivy-action. This repository is particularly critical as it's used by thousands of downstream projects.
Malicious Distribution
Malicious Action Tags Published
Using compromised aqua-bot credentials, attacker publishes malicious tags for trivy-action and setup-trivy, potentially affecting all downstream users.
Obfuscation coordinated spam flood
Discussion #10420 Flooded
96 spam accounts posted generic praise comments within ~30 seconds, drowning technical discussion and incident coordination. Includes troll comments referencing "sugma" and "ligma".
npm Worm CanisterWorm propagation
CanisterWorm Deployed to npm
Less than 24 hours after the Trivy compromise, TeamPCP deployed a self-propagating worm across npm. The worm uses the same ICP canister (tdtqy-oyaaa-aaaae-af2dq-cai) as the Trivy fallback C2—confirming shared infrastructure.
ICP Fallback Activated kamikaze.sh deployed
kamikaze.sh v1 Payload Active on ICP C2
The ICP canister fallback C2 (tdtqy-oyaaa-aaaae-af2dq-cai) is serving kamikaze.sh—a Kubernetes-focused payload with an Iran-targeted wiper. Monolithic 150-line bash script with embedded logic.
kamikaze.sh v2: Modular Architecture
ICP canister now redirects to Cloudflare tunnel. Payload evolved from monolithic bash to 15-line loader that fetches kube.py from C2 at runtime, then self-deletes.
kamikaze.sh v3: Now a Worm
Major pivot: no longer K8s-focused. Now a self-propagating worm targeting SSH keys and exposed Docker APIs (port 2375). Scans local /24 subnet, parses auth logs for targets.
kamikaze.sh v3.1: Two-Module Architecture
Payload split into separate modules: kube.py (K8s DaemonSets) + prop.py (worm spreading). K8s module appears degraded (placeholder base64), but worm module fully functional.
kamikaze.sh v3.2: Production-Ready Deployment
C2 infrastructure rotated. The placeholder PYTHON_B64 from v3.1 now contains actual ICP backdoor payload—v3.1 appears to have been a dev/test build.
kamikaze.sh v3.3: WAV Steganography
Payloads now hidden in WAV audio files. Python modules embedded as base64 in audio frames, extracted at runtime. Evades .py filters and static analysis.
Docker Hub Direct Push bypassing GitHub releases
aquasec/trivy:0.69.5 pushed to Docker Hub
Attacker pushes malicious image directly to Docker Hub, bypassing the GitHub release process entirely. No corresponding v0.69.5 tag exists on GitHub—this is a direct registry attack using compromised credentials. Image propagates to third-party mirrors including mirror.gcr.io.
aquasec/trivy:0.69.6 pushed to Docker Hub
Second malicious image pushed less than an hour after 0.69.5. Attacker continues to exploit Docker Hub access while GitHub-side compromise is being remediated. Also propagates to third-party mirrors.
Internal Aqua Repos Publicized via aquasec-com Org
Using compromised Argon-DevOps-Mgt service account, attacker defaced 44 repositories in aquasec-com—Aqua's internal GitHub org—in a 2-minute automated blitz. All repos renamed with tpcp-docs- prefix; internal assets now publicly exposed.
mirror.gcr.io after Aqua outreach. Confirmation.Checkmarx Ecosystem same TTPs, new targets
Malicious extensions published to OpenVSX
Two extensions pushed via compromised ast-phoenix account, 12 seconds apart: ast-results v2.53.0 and cx-dev-assist v1.7.0. Payload checks for cloud credentials before downloading second-stage from checkmarx[.]zone. VS Code Marketplace unaffected.
35 KICS versions redirected to malicious commits
Attacker compromises cx-plugins-releases service account (ID 225848595) and updates all 35 tags (v1 through v2.1.20) to point to staged commits containing setup.sh credential stealer.
Checkmarx/ast-github-action v2.3.28 compromised
Same payload deployed to AST GitHub Action. Identical TTPs: setup.sh entry point, credential scraping, encrypted exfil to checkmarx[.]zone.
LiteLLM PyPI infostealer via .pth injection
.pth auto-executionMalicious litellm 1.82.7 & 1.82.8 published to PyPI
Two malicious versions via compromised maintainer account. 1.82.8: .pth file executes on Python startup, exfil to models[.]litellm[.]cloud. 1.82.7: same KICS payload in proxy_server.py → drops p.py, exfil to checkmarx[.]zone/raw. Both harvest SSH keys, cloud credentials, env vars, crypto wallets.
Spam flood targets security disclosure
28 spam comments posted in 43 seconds to bury Issue #24512. 25 accounts used—76% overlap with Trivy spam botnet confirms same operator. Mix of compromised developer accounts (stolen tokens) and purchased dormant accounts.
BerriAI GitHub repos defaced
Via compromised krrishdholakia account, multiple BerriAI repositories had descriptions changed to "teampcp owns BerriAI".
How did they gain access to push the malicious v0.69.4 tag?
The attacker was able to push a tag to aquasecurity/trivy pointing to a malicious commit. This requires write access to the repository. Was this via a compromised PAT, GitHub App, or deploy key?
Resolution: Aqua Security confirmed the attack stemmed from incomplete containment of the March 1, 2026 incident. Credential rotation "wasn't atomic and attackers may have been privy to refreshed tokens."
Official disclosure ↗Was aqua-bot the initial access vector, or only compromised via /trivy?
The aqua-bot service account was used for lateral movement to tfsec, traceeshark, and trivy-action. However, it's unclear whether aqua-bot credentials were the initial compromise, or if they were harvested from the trivy repository's secrets after the v0.69.4 tag push triggered workflows.
Resolution: The official disclosure confirms incomplete credential rotation from the first incident allowed attackers to capture refreshed tokens, including aqua-bot credentials.
Official disclosure ↗What was the v0.70.0 trivy attacker tag?
At 17:51:17 UTC on March 19, a v0.70.0 tag was deleted. The commit (9dbb34d3ec0f) was authored by aqua-bot on March 16 — 3 days earlier — with message "Updates", modifying cmd/trivy/main.go, pkg/github/auth.go, pkg/github/repowrite.go, pkg/github/runner.go. This suggests aqua-bot compromise may predate March 19.
What was the setup-trivy poisoning?
All 7 tags (v0.2.0-v0.2.6) were force-pushed to malicious commits. Commit 8afa9b9f spoofed contributor "thara" (Tomochika Hara). Message: "Pin Trivy install script checkout to a specific commit (#28)". Spoofed date: 2026-01-15. Exposure window: ~4 hours (17:43-21:44 UTC Mar 19).
Is DarkSeek3r related?
A GitHub user "DarkSeek3r" (now deleted, user ID 266895321) was created at 2026-03-10T01:44:23. Their only public activity before account deletion was forking aquasecurity/trivy and actions/checkout — the exact repositories used in this attack.
C2 Domains & IPs
Imposter & Injected Commits
GitHub Accounts
Poisoned Releases & Images
Strings & Filenames
TeamPCP
Also known as PCPcat, Persy_PCP, ShellForce, and DeadCatx3. Emerged as a significant threat to cloud-native infrastructure in late 2025.
Self-attribution string "TeamPCP Cloud stealer" found in the trivy-action payload links this incident to the group.
Telegram: @Persy_PCP, @teampcp
View on Wiz Threat Center ↗Cloud-Native Infrastructure
Common Techniques
Flare.io Analysis
"TeamPCP Cloud-Native Ransomware" — detailed analysis of the December 2025 worm-driven campaign targeting cloud infrastructure.
Beelzebub Analysis
Next.js exploit campaign analysis — 59K compromises in 33 hours. Reveals Telegram handles and Singapore C2 infrastructure.
Trivy Supply Chain Attack: What Happened and What You Need to Know
Official vendor response with full timeline, IOCs, and remediation guidance.
TeamPCP Deploys CanisterWorm via npm
Analysis of the self-propagating npm worm using ICP canisters for C2, deployed <24 hours after Trivy compromise.
20 Days Later: Trivy Compromise Act II
Detailed technical analysis of the second Trivy compromise.
Trivy Under Attack Again: GitHub Actions Compromise
Payload analysis including three-stage exfiltration mechanism and TeamPCP Cloud stealer.
Trivy Compromised a Second Time - Malicious v0.69.4 Release
Timeline and detection guidance for the v0.69.4 supply chain attack.
MegaGame10418: The User Behind Hackerbot-Claw
Identifies MegaGame10418 as the attacker behind the February 27 Pwn Request that exfiltrated the aqua-bot PAT via memory dump technique.
aquasecurity/trivy
Malware catalog entry with IOCs and package metadata.
TeamPCP aquasec-com GitHub Org Compromise
Forensic analysis of the internal org defacement, Argon-DevOps-Mgt token compromise, and kill chain reconstruction.
Trivy GitHub Actions Compromise
Supply chain attack database entry with affected versions and remediation.
TeamPCP Cloud-Native Ransomware
Analysis of TeamPCP stealer targeting cloud credentials and CI/CD pipelines.
TeamPCP Expands Supply Chain Compromise: Spreads from Trivy to Checkmarx
Multi-stage payload analysis covering ast-github-action compromise, IMDS harvesting, and encrypted exfiltration.
Trivy Compromise Analysis
Deep dive on "Imposter Commits" technique exploiting Git alternates, GPG verification bypass detection, and three-stage payload architecture.
The Official Soundtrack of the Trivy Supply Chain Attack
Every threat actor leaves fingerprints. TeamPCP left a playlist. Songs embedded in payloads, C2 infrastructure, and attack tooling.