According to Wiz Research, attackers pushed malicious code to the Trivy scanner and its related GitHub Actions on 19 March 2026, force-pushed most release tags, and later published bad images to Docker Hub. A tool teams run to find problems became a route into their build secrets.
Timeline as Wiz reports it
- 19 March 2026: Imposter commits and malicious code were pushed. The v0.69.4 tag was pushed at 17:43:37 UTC and triggered a release.
- 22 March, about 16:00: Trivy images 0.69.5 and 0.69.6 were published to Docker Hub.
- 22 March: Wiz reported an npm worm it calls CanisterWorm using stolen publish tokens.
- 23 March: Wiz identified a parallel compromise of a different scanner's GitHub Action, kics-github-action. The post does not state a direct causal link to the Trivy compromise.
Wiz also says access was retained after incomplete containment of an earlier incident, which it treats as separate.
What was affected
- The Trivy core scanner, where v0.69.4 binaries and images were malicious.
- trivy-action, with 75 of 76 tags force-pushed to malicious versions.
- setup-trivy, with 7 tags force-pushed.
- Other repositories where malicious workflows were pushed through a compromised service account.
The tag detail is the important one. A workflow that referenced the action by tag, a normal and widely recommended habit, pulled whatever the tag pointed to on the day it ran.
What the payloads did, per the report
In the Action, the code collected credentials from the runner, including by reading the runner worker process memory, then encrypted them and sent them out. A fallback created a repository in the victim's own GitHub account to hold the data. The binary ran alongside the real scanner and stole environment variables and credentials. On machines outside CI, it set up a persistent user service.
What defenders were told to check
- Whether any v0.69.4, 0.69.5 or 0.69.6 artifacts exist in your registries, from any source.
- CI run logs from 19 and 20 March for the steps that ran the scanner or setup action.
- Repositories named tpcp-docs in your GitHub organizations.
- Whether workflows reference Actions by commit SHA rather than a mutable tag.
Wiz does not explicitly recommend rotating secrets, but credentials a CI runner could reach are the sensible place to start if any check above hits.
Why a scanner is an attractive target
A scanner runs early, reads your code and often runs where registry and cloud credentials are present. Compromising it gives an attacker a trusted foothold in many pipelines at once. That is a property of the position, not a comment on any one product.
Try it yourself
Click through it at your own pace, or open it full screen. Look for how a clean result today can change when something upstream does.
Quick check
Does pinning to a tag protect me?
Not here. Tags can be moved. Wiz recommends pinning Actions to full commit SHAs.
Does the report link the KICS compromise to Trivy?
Wiz identified it as parallel and does not state a direct causal link.
Sources
- Wiz Research, Trivy Compromised by TeamPCP, March 2026.
Last reviewed: 19 October 2026.
