--- title: How TeamPCP turned Aqua Security’s own Trivy scanner... description: TeamPCP, a threat actor group, executed a sophisticated multi-stage supply chain attack starting with Aqua Security's Trivy vulnerability scanner. By... canonical: https://daily.dev/posts/how-teampcp-turned-aqua-security-s-own-trivy-scanner-into-a-weapon-against-millions-of-developers-eeezo06er twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How TeamPCP turned Aqua Security’s own Trivy scanner into a weapon against millions of developers | daily.dev og:description: TeamPCP, a threat actor group, executed a sophisticated multi-stage supply chain attack starting with Aqua Security's Trivy vulnerability scanner. By... og:url: https://daily.dev/posts/how-teampcp-turned-aqua-security-s-own-trivy-scanner-into-a-weapon-against-millions-of-developers-eeezo06er og:image: https://api.daily.dev/og/posts/EeEZo06er.png og:image:alt: How TeamPCP turned Aqua Security’s own Trivy scanner into a weapon against millions of developers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How TeamPCP turned Aqua Security’s own Trivy scanner into a weapon against millions of developers **[The New Stack](https://daily.dev/sources/newstack)** · 7 min read · 0 upvotes · 0 comments ## Summary TeamPCP, a threat actor group, executed a sophisticated multi-stage supply chain attack starting with Aqua Security's Trivy vulnerability scanner. By exploiting a GitHub Actions misconfiguration, they stole credentials, trojanized Trivy binaries and actions, and spread malware across npm packages via a self-propagating worm called CanisterWorm. The attack chain compromised CI/CD pipelines across millions of developer environments, stealing cloud credentials, SSH keys, Kubernetes tokens, and more. The group claims to have obtained 300 GB of compressed credentials from projects downloaded over 100 million times monthly. Security experts recommend rotating all credentials, pinning GitHub Actions to commit SHAs instead of tags, and treating security tools as versioned dependencies with checksum verification. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [1K\+ cloud environments infected via Trivy attack](https://daily.dev/posts/1k-cloud-environments-infected-via-trivy-attack-i6q0a8ukt) · The Register · 0 upvotes · 0 comments - [Sophisticated Supply Chain Attack Targeting Trivy Expands to Checkmarx, LiteLLM](https://daily.dev/posts/sophisticated-supply-chain-attack-targeting-trivy-expands-to-checkmarx-litellm-setw9szuc) · DevOps.com · 0 upvotes · 0 comments - [Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure](https://daily.dev/posts/weaponizing-the-protectors-teampcp-s-multi-stage-supply-chain-attack-on-security-infrastructure-fxtlie1qu) · Unit 42 · 0 upvotes · 0 comments - [Trivy Scanner Compromise Explained and What it Means For Your SaaS and CI/CD Security](https://daily.dev/posts/trivy-scanner-compromise-explained-and-what-it-means-for-your-saas-and-ci-cd-security-mphhq7ti6) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/how-teampcp-turned-aqua-security-s-own-trivy-scanner-into-a-weapon-against-millions-of-developers-eeezo06er) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How TeamPCP turned Aqua Security’s own Trivy scanner into a weapon against millions of developers","url":"https://daily.dev/posts/how-teampcp-turned-aqua-security-s-own-trivy-scanner-into-a-weapon-against-millions-of-developers-eeezo06er","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-teampcp-turned-aqua-security-s-own-trivy-scanner-into-a-weapon-against-millions-of-developers-eeezo06er"},"datePublished":"2026-03-27T17:07:38.308Z","dateModified":"2026-03-27T17:08:03.414Z","description":"TeamPCP, a threat actor group, executed a sophisticated multi-stage supply chain attack starting with Aqua Security's Trivy vulnerability scanner. By...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a18e24c87cfad47aa911ecceac695e44?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a18e24c87cfad47aa911ecceac695e44?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The New Stack","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The New Stack","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/newstack","url":"https://daily.dev/sources/newstack"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-teampcp-turned-aqua-security-s-own-trivy-scanner-into-a-weapon-against-millions-of-developers-eeezo06er","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,cicd,github-actions,npm","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The New Stack","item":"https://daily.dev/sources/newstack"},{"@type":"ListItem","position":3,"name":"How TeamPCP turned Aqua Security’s own Trivy scanner into a weapon against millions of developers"}]} ```