Investigating Two Variants of the Trivy Supply-Chain Compromise

In March 2026 the TeamPCP threat actor compromised the open-source Trivy scanner (GitHub Action and container image) to distribute credential-stealing payloads across multiple ecosystems; one variant exfiltrates secrets during CI runs, while the binary variant includes a persistent systemd-backed backdoor fetching second-stage payloads from an ICP-hosted C2. The report includes reverse-engineering details, CloudTrail tracing showing active AWS enumeration with stolen keys, S3 exposure concerns, attacker infrastructure (IPs, domains, MinIO), and a comprehensive set of IOCs and mitigation recommendations.