How TeamPCP turned Aqua Security’s own Trivy scanner into a weapon against millions of developers

TeamPCP breached Aqua Security’s Trivy CI/CD pipeline and GitHub repos on March 19, 2026 and trojanized Trivy releases.

The attackers exfiltrated CI/CD credentials and used them to compromise dozens of npm packages and the Python package LiteLLM.

Malicious Trivy binaries installed persistent backdoors that polled an Internet Computer canister and the campaign spread via a CanisterWorm npm attack.

Palo Alto Networks described the campaign as a five‑phase chain including tag poisoning, three‑stage credential theft, and persistent backdoors.