Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack

Update March 23, 17:40 UTC: Wiz Research has identified a parallel compromise of kics-github-action On March 19, 2026, threat actors compromised Aqua Security's Trivy vulnerability scanner, injecting credential-stealing malware into official releases and GitHub Actions. While Aqua reports they have since removed the malicious releases, organizations using Trivy should audit their environments immediately.

Update March 22, 13:15 UTC: Wiz Research continues to track TeamPCP activity following the initial Trivy compromise. The threat actor has expanded ope…