Loading
Get Access
Subscribe
The TeamPCP threat group successfully compromised Aqua Security's supply chain, specifically targeting the Trivy vulnerability scanner. Attackers distributed malicious versions (0.69.4–0.69.6) containing infostealer malware via official releases and Docker Hub. Furthermore, the actors hijacked the Aqua Security GitHub organization, defacing 44 repositories and pushing unauthorized tags to manipulate automated build processes.
This incident represents a severe supply chain compromise that weaponized a trusted security tool to deliver malware directly into developer environments. By targeting CI/CD pipelines, the attackers gained the potential to harvest sensitive credentials and inject malicious code into downstream software products. The breadth of the repository defacement indicates a significant breach of administrative access within the vendor's development infrastructure.
Advisory purposes only · QPulse Security Intelligence Platform · 2026 · Brief #00339
