SysdigPublished
TeamPCP expands: Supply chain compromise spreads from Trivy to Checkmarx GitHub Actions
By Sysdig Threat Research Team
Excerpt
On March 19, 2026, the threat actor known as TeamPCP compromised Aqua Security's Trivy vulnerability scanner and its associated GitHub Actions, injecting a credential-stealing payload into CI/CD pipelines across thousands of repositories. The incident was widely reported, with detailed analysis from StepSecurity and others.
What has not yet been publicly reported is that the same attack pattern subsequently appeared in a second, unrelated GitHub Action for Checkmarx's AST. The Sysdig Threat Res…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Sysdig on sysdig.com.
Mentioned in the excerpt
More from Sysdig3
- JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI modelsSysdig · Published 20 Jul
- JADEPUFFER: Agentic ransomware for automated database extortionSysdig · Published 1 Jul
- REPORT. 2023 Global Cloud Threat ReportSysdig · Added 3 May
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- Investigating Ephemeral Supply Chain TamperingMandiant (Google) · Published 15 Oct
